<div dir="ltr">Thanks Lukasz for the patch, looks like it is reviewed by.<div><a class="gmail_plusreply" id="plusReplyChip-0" href="mailto:daniel@ffwll.ch" tabindex="-1">@daniel@ffwll.ch</a> or <a class="gmail_plusreply" id="plusReplyChip-1" href="mailto:airlied@gmail.com" tabindex="-1">@airlied@gmail.com</a> , could any of you ack this as well, so I can go ahead and push this to drm-misc-fixes branch? </div><div> </div><div>Regards</div><div>Manasi</div></div> <div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Oct 5, 2023 at 6:35 AM Lukasz Majczak <<a href="mailto:lma@semihalf.com">lma@semihalf.com</a>> wrote: </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">wt., 26 wrz 2023 o 16:01 Radosław Biernacki <<a href="mailto:rad@chromium.org" target="_blank">rad@chromium.org</a>> napisał(a): > > On Fri, Sep 22, 2023 at 8:34 AM Lukasz Majczak <<a href="mailto:lma@semihalf.com" target="_blank">lma@semihalf.com</a>> wrote: > > > > As drm_dp_get_mst_branch_device_by_guid() is called from > > drm_dp_get_mst_branch_device_by_guid(), mstb parameter has to be checked, > > otherwise NULL dereference may occur in the call to > > the memcpy() and cause following: > > > > [12579.365869] BUG: kernel NULL pointer dereference, address: 0000000000000049 > > [12579.365878] #PF: supervisor read access in kernel mode > > [12579.365880] #PF: error_code(0x0000) - not-present page > > [12579.365882] PGD 0 P4D 0 > > [12579.365887] Oops: 0000 [#1] PREEMPT SMP NOPTI > > ... > > [12579.365895] Workqueue: events_long drm_dp_mst_up_req_work > > [12579.365899] RIP: 0010:memcmp+0xb/0x29 > > [12579.365921] Call Trace: > > [12579.365927] get_mst_branch_device_by_guid_helper+0x22/0x64 > > [12579.365930] drm_dp_mst_up_req_work+0x137/0x416 > > [12579.365933] process_one_work+0x1d0/0x419 > > [12579.365935] worker_thread+0x11a/0x289 > > [12579.365938] kthread+0x13e/0x14f > > [12579.365941] ? process_one_work+0x419/0x419 > > [12579.365943] ? kthread_blkcg+0x31/0x31 > > [12579.365946] ret_from_fork+0x1f/0x30 > > > > As get_mst_branch_device_by_guid_helper() is recursive, moving condition > > to the first line allow to remove a similar one for step over of NULL elements > > inside a loop. > > > > Fixes: 5e93b8208d3c ("drm/dp/mst: move GUID storage from mgr, port to only mst branch") > > Cc: <<a href="mailto:stable@vger.kernel.org" target="_blank">stable@vger.kernel.org</a>> # 4.14+ > > Signed-off-by: Lukasz Majczak <<a href="mailto:lma@semihalf.com" target="_blank">lma@semihalf.com</a>> > > --- > > > > v2->v3: > > * Fixed patch description. > > > > drivers/gpu/drm/display/drm_dp_mst_topology.c | 6 +++--- > > 1 file changed, 3 insertions(+), 3 deletions(-) > > > > diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c b/drivers/gpu/drm/display/drm_dp_mst_topology.c > > index ed96cfcfa304..8c929ef72c72 100644 > > --- a/drivers/gpu/drm/display/drm_dp_mst_topology.c > > +++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c > > @@ -2574,14 +2574,14 @@ static struct drm_dp_mst_branch *get_mst_branch_device_by_guid_helper( > > struct drm_dp_mst_branch *found_mstb; > > struct drm_dp_mst_port *port; > > > > + if (!mstb) > > + return NULL; > > + > > if (memcmp(mstb->guid, guid, 16) == 0) > > return mstb; > > > > > > list_for_each_entry(port, &mstb->ports, next) { > > - if (!port->mstb) > > - continue; > > - > > found_mstb = get_mst_branch_device_by_guid_helper(port->mstb, guid); > > > > if (found_mstb) > > -- > > 2.42.0.515.g380fc7ccd1-goog > > > > Reviewed-by: Radoslaw Biernacki <<a href="mailto:rad@chromium.org" target="_blank">rad@chromium.org</a>> Hi, Is there anything more I should do with this patch? Thanks, Lukasz </blockquote></div>