Messages in this thread | | | Subject | Re: [PATCH v2] gpu: radeon: fix a potential NULL-pointer dereference | From | Michel Dänzer <> | Date | Tue, 26 Mar 2019 10:51:04 +0100 |
| |
On 2019-03-25 10:05 p.m., Kangjie Lu wrote: > In case alloc_workqueue fails, the fix frees memory and > returns -ENOMEM to avoid potential NULL pointer dereference. > > Signed-off-by: Kangjie Lu <kjlu@umn.edu> > --- > v2: use radeon_crtc_destroy to properly clean up resources as > suggested by Michel Dänzer <michel@daenzer.net> > > [...] > > @@ -671,13 +671,18 @@ static void radeon_crtc_init(struct drm_device *dev, int index) > > radeon_crtc = kzalloc(sizeof(struct radeon_crtc) + (RADEONFB_CONN_LIMIT * sizeof(struct drm_connector *)), GFP_KERNEL); > if (radeon_crtc == NULL) > - return; > + return -ENOMEM; > > drm_crtc_init(dev, &radeon_crtc->base, &radeon_crtc_funcs); > > drm_mode_crtc_set_gamma_size(&radeon_crtc->base, 256); > radeon_crtc->crtc_id = index; > radeon_crtc->flip_queue = alloc_workqueue("radeon-crtc", WQ_HIGHPRI, 0); > + if (!radeon_crtc->flip_queue) { > + DRM_ERROR("failed to allocate the flip queue\n"); > + radeon_crtc_destroy(&radeon_crtc->base); > + return -ENOMEM; > + }
radeon_crtc_destroy currently unconditionally calls:
destroy_workqueue(radeon_crtc->flip_queue);
AFAICT destroy_workqueue will blow up if NULL is passed to it, so radeon_crtc_destroy needs to check for that.
-- Earthling Michel Dänzer | https://www.amd.com Libre software enthusiast | Mesa and X developer
| |