[PATCH] drm/vmwgfx: avoid null pointer dereference at failure paths (original) (raw)
Alexey Khoroshilov khoroshilov at ispras.ru
Fri Feb 28 13:20:18 PST 2014
- Previous message: [Bug 75619] [865g] GPU hang playing SimCity 3000
- Next message: [PATCH] MAINTAINERS: add maintainer entry for Armada DRM driver
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
vmw_takedown_otable_base() and vmw_mob_unbind() check for potential vmw_fifo_reserve() failure and print error message, but then immediately dereference NULL pointer.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov at ispras.ru>
drivers/gpu/drm/vmwgfx/vmwgfx_mob.c | 35 +++++++++++++++++++---------------- 1 file changed, 19 insertions(+), 16 deletions(-)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c b/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c index d4a5a19cb8c3..04a64b8cd3cd 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c @@ -188,18 +188,20 @@ static void vmw_takedown_otable_base(struct vmw_private *dev_priv, bo = otable->page_table->pt_bo; cmd = vmw_fifo_reserve(dev_priv, sizeof(*cmd)); - if (unlikely(cmd == NULL)) - DRM_ERROR("Failed reserving FIFO space for OTable setup.\n");
- memset(cmd, 0, sizeof(*cmd));
- cmd->header.id = SVGA_3D_CMD_SET_OTABLE_BASE;
- cmd->header.size = sizeof(cmd->body);
- cmd->body.type = type;
- cmd->body.baseAddress = 0;
- cmd->body.sizeInBytes = 0;
- cmd->body.validSizeInBytes = 0;
- cmd->body.ptDepth = SVGA3D_MOBFMT_INVALID;
- vmw_fifo_commit(dev_priv, sizeof(*cmd));
if (unlikely(cmd == NULL)) {
DRM_ERROR("Failed reserving FIFO space for OTable ""takedown.\n");} else {
memset(cmd, 0, sizeof(*cmd));cmd->header.id = SVGA_3D_CMD_SET_OTABLE_BASE;cmd->header.size = sizeof(cmd->body);cmd->body.type = type;cmd->body.baseAddress = 0;cmd->body.sizeInBytes = 0;cmd->body.validSizeInBytes = 0;cmd->body.ptDepth = SVGA3D_MOBFMT_INVALID;vmw_fifo_commit(dev_priv, sizeof(*cmd));}
if (bo) { int ret;
@@ -562,11 +564,12 @@ void vmw_mob_unbind(struct vmw_private *dev_priv, if (unlikely(cmd == NULL)) { DRM_ERROR("Failed reserving FIFO space for Memory " "Object unbinding.\n"); + } else { + cmd->header.id = SVGA_3D_CMD_DESTROY_GB_MOB; + cmd->header.size = sizeof(cmd->body); + cmd->body.mobid = mob->id; + vmw_fifo_commit(dev_priv, sizeof(*cmd)); } - cmd->header.id = SVGA_3D_CMD_DESTROY_GB_MOB; - cmd->header.size = sizeof(cmd->body); - cmd->body.mobid = mob->id; - vmw_fifo_commit(dev_priv, sizeof(*cmd)); if (bo) { vmw_fence_single_bo(bo, NULL); ttm_bo_unreserve(bo);
1.8.3.2
- Previous message: [Bug 75619] [865g] GPU hang playing SimCity 3000
- Next message: [PATCH] MAINTAINERS: add maintainer entry for Armada DRM driver
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]