Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ce35b7ed authored by Venkateswara Rao Tadikonda's avatar Venkateswara Rao Tadikonda Committed by Gerrit - the friendly Code Review server
Browse files

drm/mm: Fix NULL pointer dereference in allocator 



While searching for first hole (get_first_hole) and next free hole
(get_next_hole) from rbtree, rb_first() and rb_next() functions may
return NULL pointer. A NULL pointer check can avoid the NULL pointer
dereference.

Change-Id: I21c918fff3ae995a9d8b2201030401d80ed1fd9e
Signed-off-by: default avatarVenkateswara Rao Tadikonda <vtadik@codeaurora.org>
parent 591d08f7

drivers/gpu/drm/drm_mm.c

+9 −2
Original line number Diff line number Diff line
@@ -541,6 +541,9 @@ static struct drm_mm_node *get_first_hole(const struct drm_mm *mm, 
	if (flags & DRM_MM_SEARCH_BOTTOM_UP) {

		struct rb_node *node = rb_first(&mm->holes_tree);



		if (!node)

			return NULL;



		return rb_entry(node, struct drm_mm_node, hole_node);

	} else if (flags & DRM_MM_SEARCH_BELOW) {

		return list_entry((mm)->hole_stack.prev,
@@ -555,8 +558,12 @@ static struct drm_mm_node *get_next_hole(struct drm_mm_node *entry, 
		enum drm_mm_search_flags flags)

{

	if (flags & DRM_MM_SEARCH_BOTTOM_UP) {

		return rb_entry(rb_next(&entry->hole_node),

				struct drm_mm_node, hole_node);

		struct rb_node *node = rb_next(&entry->hole_node);



		if (!node)

			return NULL;



		return rb_entry(node, struct drm_mm_node, hole_node);

	} else if (flags & DRM_MM_SEARCH_BELOW) {

		return list_entry(entry->hole_stack.prev,

				struct drm_mm_node, hole_stack);