[PATCH 1/3] drm/ttm: check for NULL resource in ttm_bo_kmap()

[kaii-k <harshicon28@gmail.com>]

From: Harsh Parmar <kaii02ctf@gmail.com>

A buffer object can legitimately have no backing store: a driver may
call ttm_bo_init_reserved() with zero placements, which leaves
bo->resource NULL. It can also become NULL after the backing store has
been released.

ttm_bo_kmap() dereferences bo->resource unconditionally (res->size),
causing a NULL pointer dereference and kernel oops when called on such a
buffer.

Bail out with -EINVAL if the buffer has no backing store.

Fixes: d3116756a710 ("drm/ttm: rename bo->mem and make it a pointer")
Signed-off-by: Harsh Parmar <kaii02ctf@gmail.com>
---
 drivers/gpu/drm/ttm/ttm_bo_util.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index f9458a4..158f0df 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -435,6 +435,8 @@ int ttm_bo_kmap(struct ttm_buffer_object *bo,
 
 	map->virtual = NULL;
 	map->bo = bo;
+	if (!res)
+		return -EINVAL;
 	if (num_pages > PFN_UP(res->size))
 		return -EINVAL;
 	if ((start_page + num_pages) > PFN_UP(res->size))
-- 
2.53.0