From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
alan@lxorguk.ukuu.org.uk,
Ilija Hadzic <ihadzic@research.bell-labs.com>,
Alex Deucher <alexander.deucher@amd.com>,
CAI Qian <caiqian@redhat.com>
Subject: [ 16/33] drm/radeon: fix NULL pointer dereference in UMS mode
Date: Fri, 18 Jan 2013 17:16:41 -0800 [thread overview]
Message-ID: <20130119010351.457566020@linuxfoundation.org> (raw)
In-Reply-To: <20130119010345.885772698@linuxfoundation.org>
3.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilija Hadzic <ihadzic@research.bell-labs.com>
commit ff4bd0827764e10a428a9d39e6814c5478863f94 upstream.
In UMS mode parser->rdev is NULL, so dereferencing
will cause an oops.
Signed-off-by: Ilija Hadzic <ihadzic@research.bell-labs.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: CAI Qian <caiqian@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/radeon_cs.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -266,7 +266,7 @@ int radeon_cs_parser_init(struct radeon_
p->chunks[p->chunk_ib_idx].length_dw);
return -EINVAL;
}
- if ((p->rdev->flags & RADEON_IS_AGP)) {
+ if (p->rdev && (p->rdev->flags & RADEON_IS_AGP)) {
p->chunks[p->chunk_ib_idx].kpage[0] = kmalloc(PAGE_SIZE, GFP_KERNEL);
p->chunks[p->chunk_ib_idx].kpage[1] = kmalloc(PAGE_SIZE, GFP_KERNEL);
if (p->chunks[p->chunk_ib_idx].kpage[0] == NULL ||
@@ -570,7 +570,8 @@ static int radeon_cs_update_pages(struct
struct radeon_cs_chunk *ibc = &p->chunks[p->chunk_ib_idx];
int i;
int size = PAGE_SIZE;
- bool copy1 = (p->rdev->flags & RADEON_IS_AGP) ? false : true;
+ bool copy1 = (p->rdev && (p->rdev->flags & RADEON_IS_AGP)) ?
+ false : true;
for (i = ibc->last_copied_page + 1; i < pg_idx; i++) {
if (DRM_COPY_FROM_USER(p->ib.ptr + (i * (PAGE_SIZE/4)),
next prev parent reply other threads:[~2013-01-19 1:33 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-01-19 1:16 [ 00/33] 3.7.4-stable review Greg Kroah-Hartman
2013-01-19 1:16 ` [ 01/33] ALSA: hda/hdmi - Work around "alsactl restore" errors Greg Kroah-Hartman
2013-01-19 1:16 ` [ 02/33] sh: Fix FDPIC binary loader Greg Kroah-Hartman
2013-01-19 1:16 ` [ 03/33] firmware: make sure the fw file size is not 0 Greg Kroah-Hartman
2013-01-19 1:16 ` [ 04/33] arm64: mm: only wrprotect clean ptes if they are present Greg Kroah-Hartman
2013-01-19 1:16 ` [ 05/33] target: use correct sense code for LUN communication failure Greg Kroah-Hartman
2013-01-19 1:16 ` [ 06/33] tcm_fc: Do not indicate retry capability to initiators Greg Kroah-Hartman
2013-01-19 1:16 ` [ 07/33] tcm_fc: Do not report target role when target is not defined Greg Kroah-Hartman
2013-01-19 1:16 ` [ 08/33] target: Fix missing CMD_T_ACTIVE bit regression for pending WRITEs Greg Kroah-Hartman
2013-01-19 1:16 ` [ 09/33] target: Fix use-after-free in LUN RESET handling Greg Kroah-Hartman
2013-01-19 1:16 ` [ 10/33] target: Release se_cmd when LUN lookup fails for TMR Greg Kroah-Hartman
2013-01-19 1:16 ` [ 11/33] s390/time: fix sched_clock() overflow Greg Kroah-Hartman
2013-01-19 1:16 ` [ 12/33] x86/Sandy Bridge: reserve pages when integrated graphics is present Greg Kroah-Hartman
2013-01-19 1:16 ` [ 13/33] ALSA: usb - fix race in creation of M-Audio Fast track pro driver Greg Kroah-Hartman
2013-01-19 1:16 ` [ 14/33] ext4: init pagevec in ext4_da_block_invalidatepages Greg Kroah-Hartman
2013-01-19 1:16 ` [ 15/33] usb: chipidea: Allow disabling streaming not only in udc mode Greg Kroah-Hartman
2013-01-19 1:16 ` Greg Kroah-Hartman [this message]
2013-01-19 1:16 ` [ 17/33] drm/radeon: fix a bogus kfree Greg Kroah-Hartman
2013-01-19 1:16 ` [ 18/33] target: Add link_magic for fabric allow_link destination target_items Greg Kroah-Hartman
2013-01-19 1:16 ` [ 19/33] intel-iommu: Prevent devices with RMRRs from being placed into SI Domain Greg Kroah-Hartman
2013-01-19 1:16 ` [ 20/33] igb: release already assigned MSI-X interrupts if setup fails Greg Kroah-Hartman
2013-01-19 1:16 ` [ 21/33] xen/grant-table: correctly initialize grant table version 1 Greg Kroah-Hartman
2013-01-19 1:16 ` [ 22/33] xen: Fix stack corruption in xen_failsafe_callback for 32bit PVOPS guests Greg Kroah-Hartman
2013-01-19 1:16 ` [ 23/33] USB: io_ti: Fix NULL dereference in chase_port() Greg Kroah-Hartman
2013-01-19 1:16 ` [ 24/33] USB: option: add TP-LINK HSUPA Modem MA180 Greg Kroah-Hartman
2013-01-19 1:16 ` [ 25/33] USB: option: blacklist network interface on ONDA MT8205 4G LTE Greg Kroah-Hartman
2013-01-19 1:16 ` [ 26/33] serial:ifx6x60:Delete SPI timer when shut down port Greg Kroah-Hartman
2013-01-19 1:16 ` [ 27/33] tty: serial: vt8500: fix return value check in vt8500_serial_probe() Greg Kroah-Hartman
2013-01-19 1:16 ` [ 28/33] tty: 8250_dw: Fix inverted arguments to serial_out in IRQ handler Greg Kroah-Hartman
2013-01-19 1:16 ` [ 29/33] 8250/16?50: Add support for Broadcom TruManage redirected serial port Greg Kroah-Hartman
2013-01-19 1:16 ` [ 30/33] staging: wlan-ng: Fix clamping of returned SSID length Greg Kroah-Hartman
2013-01-19 1:16 ` [ 31/33] staging: vt6656: Fix inconsistent structure packing Greg Kroah-Hartman
2013-01-19 1:16 ` [ 32/33] mxs: uart: fix setting RTS from software Greg Kroah-Hartman
2013-01-19 1:16 ` [ 33/33] pty: return EINVAL for TIOCGPTN for BSD ptys Greg Kroah-Hartman
2013-01-19 18:51 ` [ 00/33] 3.7.4-stable review Shuah Khan
2013-01-20 9:22 ` Satoru Takeuchi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130119010351.457566020@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=alexander.deucher@amd.com \
--cc=caiqian@redhat.com \
--cc=ihadzic@research.bell-labs.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox