[PATCH v3] drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper()

[Manasi Navare]

Thanks Lukasz for the patch, looks like it is reviewed by.
@daniel at ffwll.ch <daniel at ffwll.ch>  or @airlied at gmail.com
<airlied at gmail.com> , could any of you ack this as well, so I can go ahead
and push this to drm-misc-fixes branch?

Regards
Manasi

On Thu, Oct 5, 2023 at 6:35 AM Lukasz Majczak <lma at semihalf.com> wrote:

> wt., 26 wrz 2023 o 16:01 Radosław Biernacki <rad at chromium.org> napisał(a):
> >
> > On Fri, Sep 22, 2023 at 8:34 AM Lukasz Majczak <lma at semihalf.com> wrote:
> > >
> > > As drm_dp_get_mst_branch_device_by_guid() is called from
> > > drm_dp_get_mst_branch_device_by_guid(), mstb parameter has to be
> checked,
> > > otherwise NULL dereference may occur in the call to
> > > the memcpy() and cause following:
> > >
> > > [12579.365869] BUG: kernel NULL pointer dereference, address:
> 0000000000000049
> > > [12579.365878] #PF: supervisor read access in kernel mode
> > > [12579.365880] #PF: error_code(0x0000) - not-present page
> > > [12579.365882] PGD 0 P4D 0
> > > [12579.365887] Oops: 0000 [#1] PREEMPT SMP NOPTI
> > > ...
> > > [12579.365895] Workqueue: events_long drm_dp_mst_up_req_work
> > > [12579.365899] RIP: 0010:memcmp+0xb/0x29
> > > [12579.365921] Call Trace:
> > > [12579.365927] get_mst_branch_device_by_guid_helper+0x22/0x64
> > > [12579.365930] drm_dp_mst_up_req_work+0x137/0x416
> > > [12579.365933] process_one_work+0x1d0/0x419
> > > [12579.365935] worker_thread+0x11a/0x289
> > > [12579.365938] kthread+0x13e/0x14f
> > > [12579.365941] ? process_one_work+0x419/0x419
> > > [12579.365943] ? kthread_blkcg+0x31/0x31
> > > [12579.365946] ret_from_fork+0x1f/0x30
> > >
> > > As get_mst_branch_device_by_guid_helper() is recursive, moving
> condition
> > > to the first line allow to remove a similar one for step over of NULL
> elements
> > > inside a loop.
> > >
> > > Fixes: 5e93b8208d3c ("drm/dp/mst: move GUID storage from mgr, port to
> only mst branch")
> > > Cc: <stable at vger.kernel.org> # 4.14+
> > > Signed-off-by: Lukasz Majczak <lma at semihalf.com>
> > > ---
> > >
> > > v2->v3:
> > > * Fixed patch description.
> > >
> > >  drivers/gpu/drm/display/drm_dp_mst_topology.c | 6 +++---
> > >  1 file changed, 3 insertions(+), 3 deletions(-)
> > >
> > > diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c
> b/drivers/gpu/drm/display/drm_dp_mst_topology.c
> > > index ed96cfcfa304..8c929ef72c72 100644
> > > --- a/drivers/gpu/drm/display/drm_dp_mst_topology.c
> > > +++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c
> > > @@ -2574,14 +2574,14 @@ static struct drm_dp_mst_branch
> *get_mst_branch_device_by_guid_helper(
> > >         struct drm_dp_mst_branch *found_mstb;
> > >         struct drm_dp_mst_port *port;
> > >
> > > +       if (!mstb)
> > > +               return NULL;
> > > +
> > >         if (memcmp(mstb->guid, guid, 16) == 0)
> > >                 return mstb;
> > >
> > >
> > >         list_for_each_entry(port, &mstb->ports, next) {
> > > -               if (!port->mstb)
> > > -                       continue;
> > > -
> > >                 found_mstb =
> get_mst_branch_device_by_guid_helper(port->mstb, guid);
> > >
> > >                 if (found_mstb)
> > > --
> > > 2.42.0.515.g380fc7ccd1-goog
> > >
> >
> > Reviewed-by: Radoslaw Biernacki <rad at chromium.org>
>
> Hi,
>
> Is there anything more I should do with this patch?
>
> Thanks,
> Lukasz
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/dri-devel/attachments/20231006/5ea001a0/attachment.htm>