* [PATCH] drm/vmwgfx: avoid null pointer dereference at failure paths
@ 2014-02-28 21:20 Alexey Khoroshilov
2014-03-01 16:29 ` Thomas Hellstrom
0 siblings, 1 reply; 2+ messages in thread
From: Alexey Khoroshilov @ 2014-02-28 21:20 UTC (permalink / raw)
To: David Airlie, Thomas Hellstrom
Cc: Alexey Khoroshilov, Jakob Bornecrant, dri-devel, linux-kernel,
ldv-project
vmw_takedown_otable_base() and vmw_mob_unbind() check for
potential vmw_fifo_reserve() failure and print error message,
but then immediately dereference NULL pointer.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
---
drivers/gpu/drm/vmwgfx/vmwgfx_mob.c | 35 +++++++++++++++++++----------------
1 file changed, 19 insertions(+), 16 deletions(-)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c b/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c
index d4a5a19cb8c3..04a64b8cd3cd 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c
@@ -188,18 +188,20 @@ static void vmw_takedown_otable_base(struct vmw_private *dev_priv,
bo = otable->page_table->pt_bo;
cmd = vmw_fifo_reserve(dev_priv, sizeof(*cmd));
- if (unlikely(cmd == NULL))
- DRM_ERROR("Failed reserving FIFO space for OTable setup.\n");
-
- memset(cmd, 0, sizeof(*cmd));
- cmd->header.id = SVGA_3D_CMD_SET_OTABLE_BASE;
- cmd->header.size = sizeof(cmd->body);
- cmd->body.type = type;
- cmd->body.baseAddress = 0;
- cmd->body.sizeInBytes = 0;
- cmd->body.validSizeInBytes = 0;
- cmd->body.ptDepth = SVGA3D_MOBFMT_INVALID;
- vmw_fifo_commit(dev_priv, sizeof(*cmd));
+ if (unlikely(cmd == NULL)) {
+ DRM_ERROR("Failed reserving FIFO space for OTable "
+ "takedown.\n");
+ } else {
+ memset(cmd, 0, sizeof(*cmd));
+ cmd->header.id = SVGA_3D_CMD_SET_OTABLE_BASE;
+ cmd->header.size = sizeof(cmd->body);
+ cmd->body.type = type;
+ cmd->body.baseAddress = 0;
+ cmd->body.sizeInBytes = 0;
+ cmd->body.validSizeInBytes = 0;
+ cmd->body.ptDepth = SVGA3D_MOBFMT_INVALID;
+ vmw_fifo_commit(dev_priv, sizeof(*cmd));
+ }
if (bo) {
int ret;
@@ -562,11 +564,12 @@ void vmw_mob_unbind(struct vmw_private *dev_priv,
if (unlikely(cmd == NULL)) {
DRM_ERROR("Failed reserving FIFO space for Memory "
"Object unbinding.\n");
+ } else {
+ cmd->header.id = SVGA_3D_CMD_DESTROY_GB_MOB;
+ cmd->header.size = sizeof(cmd->body);
+ cmd->body.mobid = mob->id;
+ vmw_fifo_commit(dev_priv, sizeof(*cmd));
}
- cmd->header.id = SVGA_3D_CMD_DESTROY_GB_MOB;
- cmd->header.size = sizeof(cmd->body);
- cmd->body.mobid = mob->id;
- vmw_fifo_commit(dev_priv, sizeof(*cmd));
if (bo) {
vmw_fence_single_bo(bo, NULL);
ttm_bo_unreserve(bo);
--
1.8.3.2
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] drm/vmwgfx: avoid null pointer dereference at failure paths
2014-02-28 21:20 [PATCH] drm/vmwgfx: avoid null pointer dereference at failure paths Alexey Khoroshilov
@ 2014-03-01 16:29 ` Thomas Hellstrom
0 siblings, 0 replies; 2+ messages in thread
From: Thomas Hellstrom @ 2014-03-01 16:29 UTC (permalink / raw)
To: Alexey Khoroshilov
Cc: David Airlie, Jakob Bornecrant, dri-devel, linux-kernel,
ldv-project
On 02/28/2014 10:20 PM, Alexey Khoroshilov wrote:
> vmw_takedown_otable_base() and vmw_mob_unbind() check for
> potential vmw_fifo_reserve() failure and print error message,
> but then immediately dereference NULL pointer.
>
> Found by Linux Driver Verification project (linuxtesting.org).
>
> Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
> ---
> drivers/gpu/drm/vmwgfx/vmwgfx_mob.c | 35 +++++++++++++++++++----------------
> 1 file changed, 19 insertions(+), 16 deletions(-)
>
> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c b/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c
> index d4a5a19cb8c3..04a64b8cd3cd 100644
> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c
> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c
> @@ -188,18 +188,20 @@ static void vmw_takedown_otable_base(struct vmw_private *dev_priv,
>
> bo = otable->page_table->pt_bo;
> cmd = vmw_fifo_reserve(dev_priv, sizeof(*cmd));
> - if (unlikely(cmd == NULL))
> - DRM_ERROR("Failed reserving FIFO space for OTable setup.\n");
> -
> - memset(cmd, 0, sizeof(*cmd));
> - cmd->header.id = SVGA_3D_CMD_SET_OTABLE_BASE;
> - cmd->header.size = sizeof(cmd->body);
> - cmd->body.type = type;
> - cmd->body.baseAddress = 0;
> - cmd->body.sizeInBytes = 0;
> - cmd->body.validSizeInBytes = 0;
> - cmd->body.ptDepth = SVGA3D_MOBFMT_INVALID;
> - vmw_fifo_commit(dev_priv, sizeof(*cmd));
> + if (unlikely(cmd == NULL)) {
> + DRM_ERROR("Failed reserving FIFO space for OTable "
> + "takedown.\n");
> + } else {
> + memset(cmd, 0, sizeof(*cmd));
> + cmd->header.id = SVGA_3D_CMD_SET_OTABLE_BASE;
> + cmd->header.size = sizeof(cmd->body);
> + cmd->body.type = type;
> + cmd->body.baseAddress = 0;
> + cmd->body.sizeInBytes = 0;
> + cmd->body.validSizeInBytes = 0;
> + cmd->body.ptDepth = SVGA3D_MOBFMT_INVALID;
> + vmw_fifo_commit(dev_priv, sizeof(*cmd));
> + }
>
> if (bo) {
> int ret;
> @@ -562,11 +564,12 @@ void vmw_mob_unbind(struct vmw_private *dev_priv,
> if (unlikely(cmd == NULL)) {
> DRM_ERROR("Failed reserving FIFO space for Memory "
> "Object unbinding.\n");
> + } else {
> + cmd->header.id = SVGA_3D_CMD_DESTROY_GB_MOB;
> + cmd->header.size = sizeof(cmd->body);
> + cmd->body.mobid = mob->id;
> + vmw_fifo_commit(dev_priv, sizeof(*cmd));
> }
> - cmd->header.id = SVGA_3D_CMD_DESTROY_GB_MOB;
> - cmd->header.size = sizeof(cmd->body);
> - cmd->body.mobid = mob->id;
> - vmw_fifo_commit(dev_priv, sizeof(*cmd));
> if (bo) {
> vmw_fence_single_bo(bo, NULL);
> ttm_bo_unreserve(bo);
Thanks. I'll queue this for the next vmwgfx-fixes PULL.
/Thomas
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2014-03-01 16:29 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-02-28 21:20 [PATCH] drm/vmwgfx: avoid null pointer dereference at failure paths Alexey Khoroshilov
2014-03-01 16:29 ` Thomas Hellstrom
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox