From patchwork Fri Nov 24 10:04:15 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Katya Orlova X-Patchwork-Id: 169360 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:ce62:0:b0:403:3b70:6f57 with SMTP id o2csp1049292vqx; Fri, 24 Nov 2023 02:04:58 -0800 (PST) X-Google-Smtp-Source: AGHT+IEplrqNcvX1l8Rrazu2W7K2asNajkj/oZtNlo8KZdOOgto+yIVH+VELgAQ1n7IMta7BizyL X-Received: by 2002:a05:6a20:431e:b0:189:2e8f:d34d with SMTP id h30-20020a056a20431e00b001892e8fd34dmr2599616pzk.42.1700820297816; Fri, 24 Nov 2023 02:04:57 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1700820297; cv=none; d=google.com; s=arc-20160816; b=JhO8TT+byipOSPAjIzftZROlEI8BJ+J9+tX3I5dmZdTTKI3L3VGOqiQWUKMteoEpSJ 7dYSFvfw7qm6pVmZMtEIuQRBh/3o6/2qRJgTOKkc1HP7CowmRt/HMvpRgBYxmVOo23gR wWByCHE8ST8Ur7gHIgjvuz5Fcm7gSmLQihOGcWDJD73t4ymZTj6OhKqJuKvLgy/lktH4 tjETieM/1SLxCfKXTadCo13MN7UYFkNY17pfPei5XYii/xARS6ZRR21q2iBph3kMsgm6 RuDCi8YZSAwA0gfO6EYm/KKguSIK2GAw5gSOALyIohpGSX3WLSoQ/0FgKGjEuBQQWhE/ dMxQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature:dkim-filter; bh=bv7wrxAb8THNXxecm6v9BJx9SpSabyHKXEhGbn925+0=; fh=qJHlo3IUbq3BHalE8e8W33rZ8IE9TUSAGs/+VFOm8kY=; b=UcqR48WJFDVBvVNHSpS9akawI8gijFsVGYuEvItRnfJQfq+94QXg7wiL9fBFNGNtAG y7TXU3L3YJMkFVXr4Meu4ZaGbB+46vwXkevS/HI6P2wfuaiCJEh5FnZPULbc7eTZ583n z5Di0doVtB3bA01Sq3RLOnMybIe46ZO2QJiY8f1iqv5zgScOQlwE3bPtpiWcBkhOzaih sXkV3+585Doy3Nywa4lZYf6KDtr0gm39mQ1nPMDV/8AeNYT5+QI9fSG1DhqqUm7MEYIU /eDpDN3GAQj+OH1XMlChytxaWHWgSOvXiv1H1jOlhjzYGWFRMAw2Y15o8o3H2Hjoe0/U w4cA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@ispras.ru header.s=default header.b=TpzycoP6; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:5 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=ispras.ru Received: from groat.vger.email (groat.vger.email. [2620:137:e000::3:5]) by mx.google.com with ESMTPS id k1-20020a632401000000b005af979066c0si3211044pgk.306.2023.11.24.02.04.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 24 Nov 2023 02:04:57 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:5 as permitted sender) client-ip=2620:137:e000::3:5; Authentication-Results: mx.google.com; dkim=pass header.i=@ispras.ru header.s=default header.b=TpzycoP6; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:5 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=ispras.ru Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by groat.vger.email (Postfix) with ESMTP id A53C783B9EEA; Fri, 24 Nov 2023 02:04:46 -0800 (PST) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.11 at groat.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345427AbjKXKEh (ORCPT + 99 others); Fri, 24 Nov 2023 05:04:37 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49716 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345403AbjKXKEg (ORCPT ); Fri, 24 Nov 2023 05:04:36 -0500 Received: from mail.ispras.ru (mail.ispras.ru [83.149.199.84]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A080E1B6 for ; Fri, 24 Nov 2023 02:04:39 -0800 (PST) Received: from lvc-arm12.ispras.local (unknown [83.149.199.78]) by mail.ispras.ru (Postfix) with ESMTPSA id E3AB240F1DC5; Fri, 24 Nov 2023 10:04:36 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 mail.ispras.ru E3AB240F1DC5 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ispras.ru; s=default; t=1700820277; bh=bv7wrxAb8THNXxecm6v9BJx9SpSabyHKXEhGbn925+0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TpzycoP6tkRg1Xo+5wm2DG/F1XZvBKTIuCe6gNC6tLzDVSOd7nIq8eLFaVKDNTMiT XHLjeyW9Kf3e/w2Voyv9B2WVYULjdoUQKMU5Pt9PYGFXO+Twsmm8+09qn+c90nBAKN TU2pzUc/EM/HGrL7bPTp+ImA1hqbLMbsisw4ePp4= From: Katya Orlova To: Raphael Gallais-Pou Cc: Katya Orlova , Yannick Fertre , Philippe Cornu , David Airlie , Daniel Vetter , Maxime Coquelin , Alexandre Torgue , Philipp Zabel , dri-devel@lists.freedesktop.org, linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org Subject: [PATCH v2] drm/stm: Avoid use-after-free issues with crtc and plane Date: Fri, 24 Nov 2023 13:04:15 +0300 Message-Id: <20231124100415.21713-1-e.orlova@ispras.ru> X-Mailer: git-send-email 2.30.2 In-Reply-To: <8ec28237-8641-4c4c-b448-824ac01f313b@foss.st.com> References: MIME-Version: 1.0 X-Spam-Status: No, score=-0.9 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on groat.vger.email Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (groat.vger.email [0.0.0.0]); Fri, 24 Nov 2023 02:04:46 -0800 (PST) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1780270150882606039 X-GMAIL-MSGID: 1783439344992206900 ltdc_load() calls functions drm_crtc_init_with_planes(), drm_universal_plane_init() and drm_encoder_init(). These functions should not be called with parameters allocated with devm_kzalloc() to avoid use-after-free issues [1]. Use allocations managed by the DRM framework. Found by Linux Verification Center (linuxtesting.org). [1] https://lore.kernel.org/lkml/u366i76e3qhh3ra5oxrtngjtm2u5lterkekcz6y2jkndhuxzli@diujon4h7qwb/ Signed-off-by: Katya Orlova --- v2: use allocations managed by the DRM as Raphael Gallais-Pou suggested. Also add a fix for encoder. drivers/gpu/drm/stm/drv.c | 3 +- drivers/gpu/drm/stm/ltdc.c | 68 +++++++++----------------------------- 2 files changed, 18 insertions(+), 53 deletions(-) diff --git a/drivers/gpu/drm/stm/drv.c b/drivers/gpu/drm/stm/drv.c index e8523abef27a..152bec2c0238 100644 --- a/drivers/gpu/drm/stm/drv.c +++ b/drivers/gpu/drm/stm/drv.c @@ -25,6 +25,7 @@ #include #include #include +#include #include "ltdc.h" @@ -75,7 +76,7 @@ static int drv_load(struct drm_device *ddev) DRM_DEBUG("%s\n", __func__); - ldev = devm_kzalloc(ddev->dev, sizeof(*ldev), GFP_KERNEL); + ldev = drmm_kzalloc(ddev, sizeof(*ldev), GFP_KERNEL); if (!ldev) return -ENOMEM; diff --git a/drivers/gpu/drm/stm/ltdc.c b/drivers/gpu/drm/stm/ltdc.c index 5576fdae4962..02a7c8375f44 100644 --- a/drivers/gpu/drm/stm/ltdc.c +++ b/drivers/gpu/drm/stm/ltdc.c @@ -36,6 +36,7 @@ #include #include #include +#include #include