Home Home > GIT Browse > openSUSE-15.1
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2019-05-13 14:59:58 +0200
committerTakashi Iwai <tiwai@suse.de>2019-05-15 11:46:06 +0200
commit3e5f04f604ae78ebccaf794bb4006d5d0fce5c2c (patch)
tree66819d8f594831ab33bcc2cd1461b1dbf1e565af
parent83532ca7bde3f4c09703e53322b2e303ec5dec4c (diff)
drm/sun4i: tcon top: Fix NULL/invalid pointer dereference in
sun8i_tcon_top_un/bind (bsc#1111666).
-rw-r--r--patches.drm/drm-sun4i-tcon-top-Fix-NULL-invalid-pointer-derefere.patch73
-rw-r--r--series.conf1
2 files changed, 74 insertions, 0 deletions
diff --git a/patches.drm/drm-sun4i-tcon-top-Fix-NULL-invalid-pointer-derefere.patch b/patches.drm/drm-sun4i-tcon-top-Fix-NULL-invalid-pointer-derefere.patch
new file mode 100644
index 0000000000..c9c3d515d4
--- /dev/null
+++ b/patches.drm/drm-sun4i-tcon-top-Fix-NULL-invalid-pointer-derefere.patch
@@ -0,0 +1,73 @@
+From 1a07a94b47b1f528f39c3e6187b5eaf02efe44ea Mon Sep 17 00:00:00 2001
+From: Ondrej Jirman <megous@megous.com>
+Date: Sat, 6 Apr 2019 01:30:48 +0200
+Subject: [PATCH] drm/sun4i: tcon top: Fix NULL/invalid pointer dereference in sun8i_tcon_top_un/bind
+Git-commit: 1a07a94b47b1f528f39c3e6187b5eaf02efe44ea
+Patch-mainline: v5.1-rc5
+References: bsc#1111666
+
+There are two problems here:
+
+1. Not all clk_data->hws[] need to be initialized, depending on various
+ configured quirks. This leads to NULL ptr deref in
+ clk_hw_unregister_gate() in sun8i_tcon_top_unbind()
+2. If there is error when registering the clk_data->hws[],
+ err_unregister_gates error path will try to unregister
+ IS_ERR()=true (invalid) pointer.
+
+For problem (1) I have this stack trace:
+
+Unable to handle kernel NULL pointer dereference at virtual
+ address 0000000000000008
+Call trace:
+ clk_hw_unregister+0x8/0x18
+ clk_hw_unregister_gate+0x14/0x28
+ sun8i_tcon_top_unbind+0x2c/0x60
+ component_unbind.isra.4+0x2c/0x50
+ component_bind_all+0x1d4/0x230
+ sun4i_drv_bind+0xc4/0x1a0
+ try_to_bring_up_master+0x164/0x1c0
+ __component_add+0xa0/0x168
+ component_add+0x10/0x18
+ sun8i_dw_hdmi_probe+0x18/0x20
+ platform_drv_probe+0x3c/0x70
+ really_probe+0xcc/0x278
+ driver_probe_device+0x34/0xa8
+
+Problem (2) was identified by head scratching.
+
+Signed-off-by: Ondrej Jirman <megous@megous.com>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190405233048.3823-1-megous@megous.com
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/sun4i/sun8i_tcon_top.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun8i_tcon_top.c b/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
+index fc36e0c10a37..b1e7c76e9c17 100644
+--- a/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
++++ b/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
+@@ -227,7 +227,7 @@ static int sun8i_tcon_top_bind(struct device *dev, struct device *master,
+
+ err_unregister_gates:
+ for (i = 0; i < CLK_NUM; i++)
+- if (clk_data->hws[i])
++ if (!IS_ERR_OR_NULL(clk_data->hws[i]))
+ clk_hw_unregister_gate(clk_data->hws[i]);
+ clk_disable_unprepare(tcon_top->bus);
+ err_assert_reset:
+@@ -245,7 +245,8 @@ static void sun8i_tcon_top_unbind(struct device *dev, struct device *master,
+
+ of_clk_del_provider(dev->of_node);
+ for (i = 0; i < CLK_NUM; i++)
+- clk_hw_unregister_gate(clk_data->hws[i]);
++ if (clk_data->hws[i])
++ clk_hw_unregister_gate(clk_data->hws[i]);
+
+ clk_disable_unprepare(tcon_top->bus);
+ reset_control_assert(tcon_top->rst);
+--
+2.16.4
+
diff --git a/series.conf b/series.conf
index 9c5744cf28..63ffe1439b 100644
--- a/series.conf
+++ b/series.conf
@@ -45537,6 +45537,7 @@
patches.drm/0003-drm-mediatek-Fix-an-error-code-in-mtk_hdmi_dt_parse_.patch
patches.drm/drm-amd-display-fix-cursor-black-issue.patch
patches.drm/drm-omap-hdmi4_cec-Fix-CEC-clock-handling-for-PM.patch
+ patches.drm/drm-sun4i-tcon-top-Fix-NULL-invalid-pointer-derefere.patch
patches.drm/drm-i915-gvt-Annotate-iomem-usage.patch
patches.drm/drm-i915-gvt-Prevent-use-after-free-in-ppgtt_free_al.patch
patches.drm/drm-i915-gvt-Roundup-fb-height-into-tile-s-height-at.patch