Re: [PATCH v3] drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper()

[Radosław Biernacki]

On Fri, Sep 22, 2023 at 8:34 AM Lukasz Majczak <lma@xxxxxxxxxxxx> wrote:
>
> As drm_dp_get_mst_branch_device_by_guid() is called from
> drm_dp_get_mst_branch_device_by_guid(), mstb parameter has to be checked,
> otherwise NULL dereference may occur in the call to
> the memcpy() and cause following:
>
> [12579.365869] BUG: kernel NULL pointer dereference, address: 0000000000000049
> [12579.365878] #PF: supervisor read access in kernel mode
> [12579.365880] #PF: error_code(0x0000) - not-present page
> [12579.365882] PGD 0 P4D 0
> [12579.365887] Oops: 0000 [#1] PREEMPT SMP NOPTI
> ...
> [12579.365895] Workqueue: events_long drm_dp_mst_up_req_work
> [12579.365899] RIP: 0010:memcmp+0xb/0x29
> [12579.365921] Call Trace:
> [12579.365927] get_mst_branch_device_by_guid_helper+0x22/0x64
> [12579.365930] drm_dp_mst_up_req_work+0x137/0x416
> [12579.365933] process_one_work+0x1d0/0x419
> [12579.365935] worker_thread+0x11a/0x289
> [12579.365938] kthread+0x13e/0x14f
> [12579.365941] ? process_one_work+0x419/0x419
> [12579.365943] ? kthread_blkcg+0x31/0x31
> [12579.365946] ret_from_fork+0x1f/0x30
>
> As get_mst_branch_device_by_guid_helper() is recursive, moving condition
> to the first line allow to remove a similar one for step over of NULL elements
> inside a loop.
>
> Fixes: 5e93b8208d3c ("drm/dp/mst: move GUID storage from mgr, port to only mst branch")
> Cc: <stable@xxxxxxxxxxxxxxx> # 4.14+
> Signed-off-by: Lukasz Majczak <lma@xxxxxxxxxxxx>
> ---
>
> v2->v3:
> * Fixed patch description.
>
>  drivers/gpu/drm/display/drm_dp_mst_topology.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c b/drivers/gpu/drm/display/drm_dp_mst_topology.c
> index ed96cfcfa304..8c929ef72c72 100644
> --- a/drivers/gpu/drm/display/drm_dp_mst_topology.c
> +++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c
> @@ -2574,14 +2574,14 @@ static struct drm_dp_mst_branch *get_mst_branch_device_by_guid_helper(
>         struct drm_dp_mst_branch *found_mstb;
>         struct drm_dp_mst_port *port;
>
> +       if (!mstb)
> +               return NULL;
> +
>         if (memcmp(mstb->guid, guid, 16) == 0)
>                 return mstb;
>
>
>         list_for_each_entry(port, &mstb->ports, next) {
> -               if (!port->mstb)
> -                       continue;
> -
>                 found_mstb = get_mst_branch_device_by_guid_helper(port->mstb, guid);
>
>                 if (found_mstb)
> --
> 2.42.0.515.g380fc7ccd1-goog
>

Reviewed-by: Radoslaw Biernacki <rad@xxxxxxxxxxxx>