tmakin/tegra-linux-noble
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

drm: adv7511: Fix use-after-free in adv7533_attach_dsi()

Browse Source 
BugLink: https://bugs.launchpad.net/bugs/2106632

commit 81adbd3ff21c1182e06aa02c6be0bfd9ea02d8e8 upstream.

The host_node pointer was assigned and freed in adv7533_parse_dt(), and
later, adv7533_attach_dsi() uses the same. Fix this use-after-free issue
by dropping of_node_put() in adv7533_parse_dt() and calling of_node_put()
in error path of probe() and also in the remove().

Fixes: 1e4d58cd7f ("drm/bridge: adv7533: Create a MIPI DSI device")
Cc: stable@vger.kernel.org
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20241119192040.152657-2-biju.das.jz@bp.renesas.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
CVE-2024-57887
Signed-off-by: Manuel Diewald <manuel.diewald@canonical.com>
Signed-off-by: Mehmet Basaran <mehmet.basaran@canonical.com>
This commit is contained in:
Biju Das
2024-11-19 19:20:29 +00:00
committed by Mehmet Basaran
parent 7e8b70e8b5
commit 0dfa1a7c5e
2 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+8 -2
View File
@@ -1211,8 +1211,10 @@ static int adv7511_probe(struct i2c_client *i2c)
return ret;
ret = adv7511_init_regulators(adv7511);
if (ret)
return dev_err_probe(dev, ret, "failed to init regulators\n");
if (ret) {
dev_err_probe(dev, ret, "failed to init regulators\n");
goto err_of_node_put;
}
/*
* The power down GPIO is optional. If present, toggle it from active to
@@ -1332,6 +1334,8 @@ err_i2c_unregister_edid:
i2c_unregister_device(adv7511->i2c_edid);
uninit_regulators:
adv7511_uninit_regulators(adv7511);
err_of_node_put:
of_node_put(adv7511->host_node);
return ret;
}
@@ -1340,6 +1344,8 @@ static void adv7511_remove(struct i2c_client *i2c)
{
struct adv7511 *adv7511 = i2c_get_clientdata(i2c);
of_node_put(adv7511->host_node);
adv7511_uninit_regulators(adv7511);
drm_bridge_remove(&adv7511->bridge);
drivers/gpu/drm/bridge/adv7511/adv7533.c
-2
View File
@@ -181,8 +181,6 @@ int adv7533_parse_dt(struct device_node *np, struct adv7511 *adv)
if (!adv->host_node)
return -ENODEV;
of_node_put(adv->host_node);
adv->use_timing_gen = !of_property_read_bool(np,
"adi,disable-timing-generator");