Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0e34d094 authored by Tim Gardner's avatar Tim Gardner Committed by Alex Deucher
Browse files

drm/radeon: Avoid NULL pointer dereference from atom_index_iio() allocation failure 



Smatch anlysis:

drivers/gpu/drm/radeon/atom.c:1242 atom_index_iio() error: potential null
 dereference 'ctx->iio'.  (kzalloc returns null)

Also cleaned up some checks before calls to kfree(). kfree(NULL) is OK.

Cc: David Airlie <airlied@linux.ie>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: "Michel Dänzer" <michel.daenzer@amd.com>
Cc: Dave Airlie <airlied@redhat.com>
Cc: "Christian König" <christian.koenig@amd.com>
Cc: Jerome Glisse <jglisse@redhat.com>
Cc: dri-devel@lists.freedesktop.org
Signed-off-by: default avatarTim Gardner <tim.gardner@canonical.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
parent c944b2ab

drivers/gpu/drm/radeon/atom.c

+7 −2
Original line number Diff line number Diff line
@@ -1238,6 +1238,8 @@ static int atom_iio_len[] = { 1, 2, 3, 3, 3, 3, 4, 4, 4, 3 }; 
static void atom_index_iio(struct atom_context *ctx, int base)

{

	ctx->iio = kzalloc(2 * 256, GFP_KERNEL);

	if (!ctx->iio)

		return;

	while (CU8(base) == ATOM_IIO_START) {

		ctx->iio[CU8(base + 1)] = base + 2;

		base += 2;
@@ -1287,6 +1289,10 @@ struct atom_context *atom_parse(struct card_info *card, void *bios) 
	ctx->cmd_table = CU16(base + ATOM_ROM_CMD_PTR);

	ctx->data_table = CU16(base + ATOM_ROM_DATA_PTR);

	atom_index_iio(ctx, CU16(ctx->data_table + ATOM_DATA_IIO_PTR) + 4);

	if (!ctx->iio) {

		atom_destroy(ctx);

		return NULL;

	}



	str = CSTR(CU16(base + ATOM_ROM_MSG_PTR));

	while (*str && ((*str == '\n') || (*str == '\r')))
@@ -1335,7 +1341,6 @@ int atom_asic_init(struct atom_context *ctx) 


void atom_destroy(struct atom_context *ctx)

{

	if (ctx->iio)

	kfree(ctx->iio);

	kfree(ctx);

}

drivers/gpu/drm/radeon/radeon_device.c

+8 −1
Original line number Diff line number Diff line
@@ -758,6 +758,11 @@ int radeon_atombios_init(struct radeon_device *rdev) 
	atom_card_info->pll_write = cail_pll_write;



	rdev->mode_info.atom_context = atom_parse(atom_card_info, rdev->bios);

	if (!rdev->mode_info.atom_context) {

		radeon_atombios_fini(rdev);

		return -ENOMEM;

	}



	mutex_init(&rdev->mode_info.atom_context->mutex);

	radeon_atom_initialize_bios_scratch_regs(rdev->ddev);

	atom_allocate_fb_scratch(rdev->mode_info.atom_context);
@@ -777,9 +782,11 @@ void radeon_atombios_fini(struct radeon_device *rdev) 
{

	if (rdev->mode_info.atom_context) {

		kfree(rdev->mode_info.atom_context->scratch);

		kfree(rdev->mode_info.atom_context);

	}

	kfree(rdev->mode_info.atom_context);

	rdev->mode_info.atom_context = NULL;

	kfree(rdev->mode_info.atom_card_info);

	rdev->mode_info.atom_card_info = NULL;

}



/* COMBIOS */