Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f7741aa7 authored by Dan Carpenter's avatar Dan Carpenter Committed by Daniel Vetter
Browse files

drm/savage: dereferencing an error pointer 



A recent cleanup changed the kmalloc() + copy_from_user() to
memdup_user() but the error handling wasn't updated so we might call
kfree(-EFAULT) and crash.

Fixes: a6e3918b ('GPU-DRM-Savage: Use memdup_user() rather than duplicating')
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/20161012062227.GU12841@mwanda
parent 1550333c

drivers/gpu/drm/savage/savage_state.c

+1 −0
Original line number Diff line number Diff line
@@ -1004,6 +1004,7 @@ int savage_bci_cmdbuf(struct drm_device *dev, void *data, struct drm_file *file_ 
		kvb_addr = memdup_user(cmdbuf->vb_addr, cmdbuf->vb_size);

		if (IS_ERR(kvb_addr)) {

			ret = PTR_ERR(kvb_addr);

			kvb_addr = NULL;

			goto done;

		}

		cmdbuf->vb_addr = kvb_addr;