lkml.org 
[lkml]   [2020]   [Jan]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH][next] drm/i915/gem: fix null pointer dereference on vm
Date
From: Colin Ian King <colin.king@canonical.com>

Currently if the call to function context_get_vm_rcu returns
a null pointer for vm then the error exit path via label err_put
will call i915_vm_put on the null vm, causing a null pointer
dereference. Fix this by adding a null check on vm and returning
without calling the i915_vm_put.

Fixes: 5dbd2b7be61e ("drm/i915/gem: Convert vm idr to xarray")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
drivers/gpu/drm/i915/gem/i915_gem_context.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/i915/gem/i915_gem_context.c b/drivers/gpu/drm/i915/gem/i915_gem_context.c
index 5d4157e1ccf7..3e6e34ec9fa8 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c
@@ -1005,9 +1005,12 @@ static int get_ppgtt(struct drm_i915_file_private *file_priv,
err = -ENODEV;
rcu_read_lock();
vm = context_get_vm_rcu(ctx);
- if (vm)
- err = xa_alloc(&file_priv->vm_xa, &id, vm,
- xa_limit_32b, GFP_KERNEL);
+ if (!vm) {
+ rcu_read_unlock();
+ return err;
+ }
+ err = xa_alloc(&file_priv->vm_xa, &id, vm,
+ xa_limit_32b, GFP_KERNEL);
rcu_read_unlock();
if (err)
goto err_put;
--
2.24.0
\
 
 \ /
  Last update: 2020-01-23 16:15    [W:0.030 / U:0.252 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site