Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6950e23e authored by Alexey Khoroshilov's avatar Alexey Khoroshilov Committed by Thomas Hellstrom
Browse files

drm/vmwgfx: avoid null pointer dereference at failure paths 



vmw_takedown_otable_base() and vmw_mob_unbind() check for
potential vmw_fifo_reserve() failure and print error message,
but then immediately dereference NULL pointer.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
Reviewed-by: default avatarThomas Hellstrom <thellstrom@vmware.com>
parent a34417f6

drivers/gpu/drm/vmwgfx/vmwgfx_mob.c

+19 −16
Original line number Diff line number Diff line
@@ -188,9 +188,10 @@ static void vmw_takedown_otable_base(struct vmw_private *dev_priv, 


	bo = otable->page_table->pt_bo;

	cmd = vmw_fifo_reserve(dev_priv, sizeof(*cmd));

	if (unlikely(cmd == NULL))

		DRM_ERROR("Failed reserving FIFO space for OTable setup.\n");



	if (unlikely(cmd == NULL)) {

		DRM_ERROR("Failed reserving FIFO space for OTable "

			  "takedown.\n");

	} else {

		memset(cmd, 0, sizeof(*cmd));

		cmd->header.id = SVGA_3D_CMD_SET_OTABLE_BASE;

		cmd->header.size = sizeof(cmd->body);
@@ -200,6 +201,7 @@ static void vmw_takedown_otable_base(struct vmw_private *dev_priv, 
		cmd->body.validSizeInBytes = 0;

		cmd->body.ptDepth = SVGA3D_MOBFMT_INVALID;

		vmw_fifo_commit(dev_priv, sizeof(*cmd));

	}



	if (bo) {

		int ret;
@@ -562,11 +564,12 @@ void vmw_mob_unbind(struct vmw_private *dev_priv, 
	if (unlikely(cmd == NULL)) {

		DRM_ERROR("Failed reserving FIFO space for Memory "

			  "Object unbinding.\n");

	}

	} else {

		cmd->header.id = SVGA_3D_CMD_DESTROY_GB_MOB;

		cmd->header.size = sizeof(cmd->body);

		cmd->body.mobid = mob->id;

		vmw_fifo_commit(dev_priv, sizeof(*cmd));

	}

	if (bo) {

		vmw_fence_single_bo(bo, NULL);

		ttm_bo_unreserve(bo);