When adding gud properties for drm connector within the function
gud_connector_add_properties(), if the TV modes property is not added
first, drm_mode_create_tv_properties_legacy() would fail to add the TV
modes property because the tv_select_subconnector_property has already
been added.
This causes gud_connector_property_lookup() to fail when looking for
the TV modes property (returning NULL), which subsequently triggers
issue [1] when a NULL property is passed to drm_object_attach_property().
The fix ensures that within drm_mode_create_tv_properties_legacy(), the
TV modes property is correctly added regardless of whether the subconnector
property exists.
[1]
Oops: general protection fault, probably for non-canonical address
0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]
RIP: 0010:drm_object_attach_property+0x85/0x3b0
drivers/gpu/drm/drm_mode_object.c:240
Call Trace:
gud_connector_add_properties drivers/gpu/drm/gud/gud_connector.c:572 [inline]
gud_connector_create drivers/gpu/drm/gud/gud_connector.c:680 [inline]
gud_get_connectors+0x86e/0x1700 drivers/gpu/drm/gud/gud_connector.c:717
gud_probe+0x17aa/0x1c20 drivers/gpu/drm/gud/gud_drv.c:635
Fixes: f453ba046074 ("DRM: add mode setting support")
Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=1944765c3659f63d3777
Tested-by: [email protected]
Signed-off-by: Edward Adam Davis <[email protected]>
---
drivers/gpu/drm/drm_connector.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
index 11646453aaac..ecbbc967f51f 100644
--- a/drivers/gpu/drm/drm_connector.c
+++ b/drivers/gpu/drm/drm_connector.c
@@ -2175,8 +2175,12 @@ int drm_mode_create_tv_properties_legacy(struct
drm_device *dev,
struct drm_property *tv_subconnector;
unsigned int i;
- if (dev->mode_config.tv_select_subconnector_property)
+ if (dev->mode_config.tv_select_subconnector_property) {
+ if (num_modes && !dev->mode_config.legacy_tv_mode_property)
+ goto other;
+
return 0;
+ }
/*
* Basic connector properties
@@ -2199,6 +2203,7 @@ int drm_mode_create_tv_properties_legacy(struct
drm_device *dev,
goto nomem;
dev->mode_config.tv_subconnector_property = tv_subconnector;
+other:
/*
* Other, TV specific properties: margins & TV modes.
*/
--
2.43.0
