From mboxrd@z Thu Jan 1 00:00:00 1970 From: John.C.Harrison@Intel.com Subject: [RFC 04/44] drm/i915: Fix null pointer dereference in error capture Date: Thu, 26 Jun 2014 18:23:55 +0100 Message-ID: <1403803475-16337-5-git-send-email-John.C.Harrison@Intel.com> References: <1403803475-16337-1-git-send-email-John.C.Harrison@Intel.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by gabe.freedesktop.org (Postfix) with ESMTP id 7ED2B6E1C2 for ; Thu, 26 Jun 2014 10:25:25 -0700 (PDT) In-Reply-To: <1403803475-16337-1-git-send-email-John.C.Harrison@Intel.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" To: Intel-GFX@lists.freedesktop.org List-Id: intel-gfx@lists.freedesktop.org From: John Harrison The i915_gem_record_rings() code was unconditionally querying and saving state for the batch_obj of a request structure. This is not necessarily set. Thus a null pointer dereference can occur. --- drivers/gpu/drm/i915/i915_gpu_error.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/i915/i915_gpu_error.c b/drivers/gpu/drm/i915/i915_gpu_error.c index 87ec60e..0738f21 100644 --- a/drivers/gpu/drm/i915/i915_gpu_error.c +++ b/drivers/gpu/drm/i915/i915_gpu_error.c @@ -902,12 +902,13 @@ static void i915_gem_record_rings(struct drm_device *dev, * as the simplest method to avoid being overwritten * by userspace. */ - error->ring[i].batchbuffer = - i915_error_object_create(dev_priv, - request->batch_obj, - request->ctx ? - request->ctx->vm : - &dev_priv->gtt.base); + if(request->batch_obj) + error->ring[i].batchbuffer = + i915_error_object_create(dev_priv, + request->batch_obj, + request->ctx ? + request->ctx->vm : + &dev_priv->gtt.base); if (HAS_BROKEN_CS_TLB(dev_priv->dev) && ring->scratch.obj) -- 1.7.9.5