lkml.org 
[lkml]   [2022]   [Jun]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 380/452] drm/nouveau/clk: Fix an incorrect NULL check on list iterator
    Date
    From: Xiaomeng Tong <xiam0nd.tong@gmail.com>

    commit 1c3b2a27def609473ed13b1cd668cb10deab49b4 upstream.

    The bug is here:
    if (nvkm_cstate_valid(clk, cstate, max_volt, clk->temp))
    return cstate;

    The list iterator value 'cstate' will *always* be set and non-NULL
    by list_for_each_entry_from_reverse(), so it is incorrect to assume
    that the iterator value will be unchanged if the list is empty or no
    element is found (In fact, it will be a bogus pointer to an invalid
    structure object containing the HEAD). Also it missed a NULL check
    at callsite and may lead to invalid memory access after that.

    To fix this bug, just return 'encoder' when found, otherwise return
    NULL. And add the NULL check.

    Cc: stable@vger.kernel.org
    Fixes: 1f7f3d91ad38a ("drm/nouveau/clk: Respect voltage limits in nvkm_cstate_prog")
    Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com>
    Reviewed-by: Lyude Paul <lyude@redhat.com>
    Signed-off-by: Lyude Paul <lyude@redhat.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20220327075824.11806-1-xiam0nd.tong@gmail.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c | 6 ++++--
    1 file changed, 4 insertions(+), 2 deletions(-)

    --- a/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c
    +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c
    @@ -135,10 +135,10 @@ nvkm_cstate_find_best(struct nvkm_clk *c

    list_for_each_entry_from_reverse(cstate, &pstate->list, head) {
    if (nvkm_cstate_valid(clk, cstate, max_volt, clk->temp))
    - break;
    + return cstate;
    }

    - return cstate;
    + return NULL;
    }

    static struct nvkm_cstate *
    @@ -169,6 +169,8 @@ nvkm_cstate_prog(struct nvkm_clk *clk, s
    if (!list_empty(&pstate->list)) {
    cstate = nvkm_cstate_get(clk, pstate, cstatei);
    cstate = nvkm_cstate_find_best(clk, pstate, cstate);
    + if (!cstate)
    + return -EINVAL;
    } else {
    cstate = &pstate->base;
    }

    \
     
     \ /
      Last update: 2022-06-07 20:10    [W:2.720 / U:0.616 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site