From patchwork Thu Jun 13 19:17:59 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Geert Uytterhoeven X-Patchwork-Id: 13697384 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 94A12C27C75 for ; Thu, 13 Jun 2024 19:18:23 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 5E04D10EB80; Thu, 13 Jun 2024 19:18:22 +0000 (UTC) Received: from cantor.telenet-ops.be (cantor.telenet-ops.be [195.130.132.48]) by gabe.freedesktop.org (Postfix) with ESMTPS id D8D5410EB7A for ; Thu, 13 Jun 2024 19:18:10 +0000 (UTC) Received: from laurent.telenet-ops.be (laurent.telenet-ops.be [IPv6:2a02:1800:110:4::f00:19]) by cantor.telenet-ops.be (Postfix) with ESMTPS id 4W0XHh4sNCz4x1qn for ; Thu, 13 Jun 2024 21:18:08 +0200 (CEST) Received: from ramsan.of.borg ([IPv6:2a02:1810:ac12:ed80:be2a:f066:50f0:dff7]) by laurent.telenet-ops.be with bizsmtp id b7J62C0073w30qz017J6YW; Thu, 13 Jun 2024 21:18:08 +0200 Received: from rox.of.borg ([192.168.97.57]) by ramsan.of.borg with esmtp (Exim 4.95) (envelope-from ) id 1sHpwS-00Ax6j-CJ; Thu, 13 Jun 2024 21:18:06 +0200 Received: from geert by rox.of.borg with local (Exim 4.95) (envelope-from ) id 1sHpxW-00FL8T-CT; Thu, 13 Jun 2024 21:18:06 +0200 From: Geert Uytterhoeven To: Jocelyn Falempe , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Daniel Vetter Cc: Helge Deller , dri-devel@lists.freedesktop.org, linux-fbdev@vger.kernel.org, linux-renesas-soc@vger.kernel.org, Geert Uytterhoeven Subject: [PATCH v2 1/7] drm/panic: Fix uninitialized drm_scanout_buffer.set_pixel() crash Date: Thu, 13 Jun 2024 21:17:59 +0200 Message-Id: <4c250d21880ca0b97e41da7b6a101bdf07e9d015.1718305355.git.geert+renesas@glider.be> X-Mailer: git-send-email 2.34.1 In-Reply-To: References: MIME-Version: 1.0 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" No implementations of drm_plane_helper_funcs.get_scanout_buffer() fill in the optional drm_scanout_buffer.set_pixel() member. Hence the member may contain non-zero garbage, causing a crash when deferencing it during drm panic. Fix this by pre-initializing the drm_scanout_buffer object before calling drm_plane_helper_funcs.get_scanout_buffer(). Fixes: 24d07f114e4ec760 ("drm/panic: Add a set_pixel() callback to drm_scanout_buffer") Signed-off-by: Geert Uytterhoeven Reviewed-by: Jocelyn Falempe --- v2: - New. --- drivers/gpu/drm/drm_panic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c index 293d4dcbc80da7ba..fc04ed4e0b399f55 100644 --- a/drivers/gpu/drm/drm_panic.c +++ b/drivers/gpu/drm/drm_panic.c @@ -582,7 +582,7 @@ static void draw_panic_dispatch(struct drm_scanout_buffer *sb) static void draw_panic_plane(struct drm_plane *plane) { - struct drm_scanout_buffer sb; + struct drm_scanout_buffer sb = { }; int ret; unsigned long flags;