# Re: general protection fault in drm\_atomic\_set\_crtc\_for\_connector

- From: Desmond Cheong Zhi Xi \<hidden\>
- Date: 2021-08-18 09:35:54 
- List: linux-kernel-mentees
- Page: https://ratatoskr.run/linux-kernel-mentees/2021/08/15835955
- Thread: https://ratatoskr.run/linux-kernel-mentees/2021/08/15835955/t.md

```text
#syz fix: drm: fix oops in drm_atomic_set_crtc_for_connector

At the time of the bug report [1], there was the following call in update_output_state:
> 			ret = drm_atomic_set_crtc_for_connector(new_conn_state,
> 								NULL);

This was followed by
> 	if (crtc) {
> 		crtc_state = drm_atomic_get_crtc_state(conn_state->state, crtc);
> 		if (IS_ERR(crtc_state))
> 			return PTR_ERR(crtc_state);
>
> 		crtc_state->connector_mask |=
> 			drm_connector_mask(conn_state->connector);
>
> 		drm_connector_get(conn_state->connector);
> 		conn_state->crtc = crtc;
>
> 		drm_dbg_atomic(crtc->dev,
> 			       "Link [CONNECTOR:%d:%s] state %p to [CRTC:%d:%s]\n",
> 			       connector->base.id, connector->name,
> 			       conn_state, crtc->base.id, crtc->name);
> 	} else {
> 		drm_dbg_atomic(crtc->dev,
> 			       "Link [CONNECTOR:%d:%s] state %p to [NOCRTC]\n",
> 			       connector->base.id, connector->name,
> 			       conn_state);
> 	}

in drm_atomic_set_crtc_for_connector, which clearly dereferences a null pointer in the else block. This led to the reported general protection fault.

commit 0003b687ee6d("drm: fix oops in drm_atomic_set_crtc_for_connector") fixes this by getting the device from connector, which can't be NULL.

Link: https://syzkaller.appspot.com/bug?id=768a24e51bd111e0c1d6b6f4e1f09fac3c54c05d [1]

Best wishes,
Desmond
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees
```