Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
drm/crtc: Fix uninit-value bug in drm_mode_setcrtc
The connector_set contains uninitialized values when allocated with kmalloc_array. However, in the "out" branch, the logic assumes that any element in connector_set would be equal to NULL if failed to initialize, which causes the bug reported by Syzbot. The fix is to use an extra variable to keep track of how many connectors are initialized indeed, and use that variable to decrease any refcounts in the "out" branch. Reported-by: [email protected] Signed-off-by: Ziqi Zhao <[email protected]> Reported-and-tested-by: [email protected] Tested-by: Harshit Mogalapalli <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Maxime Ripard <[email protected]>
- Loading branch information