From: Ben Widawsky <benjamin.widawsky@intel.com>
To: Intel GFX <intel-gfx@lists.freedesktop.org>
Cc: Ben Widawsky <ben@bwidawsk.net>,
Ben Widawsky <benjamin.widawsky@intel.com>
Subject: [PATCH] drm/i915/ppgtt: Prevent NULL deref in reset ioctl
Date: Thu, 19 Dec 2013 15:22:40 -0800 [thread overview]
Message-ID: <1387495360-15114-1-git-send-email-benjamin.widawsky@intel.com> (raw)
If we look up an invalid context ID, the idr will return NULL. The ptr
is unconditionally dereferenced afterwards causing a problem.
Note that if the context does not exist, we still return success. This
appears to be the behavior desired by gem_reset_stats --subtest ban
Introduced in v3 of
commit 41bde5535a7d48876095926bb55b1aed5ccd6b2c
Author: Ben Widawsky <ben@bwidawsk.net>
Date: Fri Dec 6 14:11:21 2013 -0800
drm/i915: Get context early in execbuf
Cc: Mika Kuoppala <mika.kuoppala@linux.intel.com>
Signed-off-by: Ben Widawsky <ben@bwidawsk.net>
---
drivers/gpu/drm/i915/intel_uncore.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c
index e52fcce..aa4c55a 100644
--- a/drivers/gpu/drm/i915/intel_uncore.c
+++ b/drivers/gpu/drm/i915/intel_uncore.c
@@ -850,7 +850,7 @@ int i915_get_reset_stats_ioctl(struct drm_device *dev,
return ret;
ctx = i915_gem_context_get(file->driver_priv, args->ctx_id);
- if (IS_ERR(ctx)) {
+ if (IS_ERR_OR_NULL(ctx)) {
mutex_unlock(&dev->struct_mutex);
return PTR_ERR(ctx);
}
--
1.8.5.1
next reply other threads:[~2013-12-19 23:22 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-12-19 23:22 Ben Widawsky [this message]
2013-12-20 6:05 ` [PATCH] drm/i915/ppgtt: Prevent NULL deref in reset ioctl Daniel Vetter
2013-12-20 6:55 ` Ben Widawsky
2013-12-20 14:11 ` Daniel Vetter
2013-12-20 14:37 ` Jani Nikula
2013-12-20 18:21 ` Ben Widawsky
2013-12-20 18:21 ` Ben Widawsky
2013-12-22 20:55 ` [PATCH] drm/i915/ppgtt: Never return a NULL context Ben Widawsky
2014-01-01 5:46 ` [PATCH] [v2] " Ben Widawsky
2014-01-02 14:34 ` Mika Kuoppala
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1387495360-15114-1-git-send-email-benjamin.widawsky@intel.com \
--to=benjamin.widawsky@intel.com \
--cc=ben@bwidawsk.net \
--cc=intel-gfx@lists.freedesktop.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox