On Wed, Mar 31, 2021 at 07:32:06PM +0200, Greg KH wrote:
On Wed, Mar 31, 2021 at 07:34:29PM +0300, Hassan Shahbazi wrote:
quoted
The patch has fixed a NULL pointer deference crash in hiding the cursor. It
is verified by syzbot patch tester.
Reported by: syzbot
https://syzkaller.appspot.com/bug?id=defb47bf56e1c14d5687280c7bb91ce7b608b94b
Signed-off-by: Hassan Shahbazi <redacted>
---
drivers/video/fbdev/core/fbcon.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 44a5cd2f54cc..ee252d1c43c6 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -1333,8 +1333,9 @@ static void fbcon_cursor(struct vc_data *vc, int mode)
ops->cursor_flash = (mode == CM_ERASE) ? 0 : 1;
- ops->cursor(vc, info, mode, get_color(vc, info, c, 1),
- get_color(vc, info, c, 0));
+ if (ops && ops->cursor)
As ops obviously is not NULL here (you just used it on the line above),
why are you checking it again?
Yes, that's right. I will remove that check and will submit a new patch.
And what makes curser be NULL here? How can that happen?
Honestly, I don't know. I reproduced the crash on my local, followed the
stack trace, and then changed the line to avoid the crash. If you think this
patch is not the best solution, I can drop it and investigate more to find
the root cause.
Also your subject line can use some work, please make it reflect the
driver subsystem you are looking at.
This was a mistake, I did not intend to change the subject. I will ensure
the next patch reflects the subsystem.
thanks,
greg k-h
Best,
Hassan Shahbazi