提交 3552dc28 编写于 作者: X xuhuijie 提交者: Zheng Zengkai

drm: fix free illegal pointer when create drm_property_blob failed

euler inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I4RYN2
CVE: NA

---------------------------

we get (Unable to handle kernel NULL pointer dereference at virtual
address 000000000000000c) when call drm_property_blob_put().
After analysis, we get the following process:
alloc failed:
drm_atomic_set_mode_for_crtc()
    drm_property_create_blob() // failed
    state->mode_blob = ERR_PTR(-ENOMEM)
free illegal pointer:
__drm_atomic_helper_crtc_destroy_state()
    drm_property_blob_put(state->mode_blob)
	    drm_mode_object_put(&blob->base);   // here blob is ERR_PTR(-ENOMEM)
So do we have to determine if blob is an error code
before calling drm_mode_object_put().

Fixes: 6bcacf51 (drm: Add reference counting to blob properties)
Signed-off-by: Nxuhuijie <xuhuijie2@huawei.com>
Signed-off-by: NLiu Yuntao <liuyuntao10@huawei.com>
Reviewed-by: NLiu Zixian <liuzixian4@huawei.com>
Reviewed-by: Kefeng Wang<wangkefeng.wang@huawei.com>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
上级 e08471fc
......@@ -602,7 +602,7 @@ EXPORT_SYMBOL(drm_property_create_blob);
*/
void drm_property_blob_put(struct drm_property_blob *blob)
{
if (!blob)
if (IS_ERR_OR_NULL(blob))
return;
drm_mode_object_put(&blob->base);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册