* [PATCH next] drm/nouveau: Fix error pointer dereference in r535_gsp_msgq_recv()
@ 2025-02-17 7:31 Dan Carpenter
2025-02-17 14:56 ` Zhi Wang
2025-02-19 14:02 ` Danilo Krummrich
0 siblings, 2 replies; 3+ messages in thread
From: Dan Carpenter @ 2025-02-17 7:31 UTC (permalink / raw)
To: Zhi Wang
Cc: Lyude Paul, Danilo Krummrich, David Airlie, Simona Vetter,
Timur Tabi, Dave Airlie, Ben Skeggs, dri-devel, nouveau,
linux-kernel, kernel-janitors
If "rpc" is an error pointer then return directly. Otherwise it leads
to an error pointer dereference.
Fixes: 50f290053d79 ("drm/nouveau: support handling the return of large GSP message")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c
index 2075cad63805..db2602e88006 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c
@@ -348,6 +348,7 @@ r535_gsp_msgq_recv(struct nvkm_gsp *gsp, u32 gsp_rpc_len, int *retries)
if (IS_ERR(buf)) {
kvfree(info.gsp_rpc_buf);
info.gsp_rpc_buf = NULL;
+ return buf;
}
if (expected <= max_rpc_size)
--
2.47.2
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH next] drm/nouveau: Fix error pointer dereference in r535_gsp_msgq_recv()
2025-02-17 7:31 [PATCH next] drm/nouveau: Fix error pointer dereference in r535_gsp_msgq_recv() Dan Carpenter
@ 2025-02-17 14:56 ` Zhi Wang
2025-02-19 14:02 ` Danilo Krummrich
1 sibling, 0 replies; 3+ messages in thread
From: Zhi Wang @ 2025-02-17 14:56 UTC (permalink / raw)
To: Dan Carpenter
Cc: Lyude Paul, Danilo Krummrich, David Airlie, Simona Vetter,
Timur Tabi, Dave Airlie, Ben Skeggs, dri-devel, nouveau,
linux-kernel, kernel-janitors
On Mon, 17 Feb 2025 10:31:21 +0300
Dan Carpenter <dan.carpenter@linaro.org> wrote:
Thanks for catching this!
Acked-by: Zhi Wang <zhiw@nvidia.com>
> If "rpc" is an error pointer then return directly. Otherwise it leads
> to an error pointer dereference.
>
> Fixes: 50f290053d79 ("drm/nouveau: support handling the return of large GSP message")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
> ---
> drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c
> index 2075cad63805..db2602e88006 100644
> --- a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c
> +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c
> @@ -348,6 +348,7 @@ r535_gsp_msgq_recv(struct nvkm_gsp *gsp, u32 gsp_rpc_len, int *retries)
> if (IS_ERR(buf)) {
> kvfree(info.gsp_rpc_buf);
> info.gsp_rpc_buf = NULL;
> + return buf;
> }
>
> if (expected <= max_rpc_size)
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH next] drm/nouveau: Fix error pointer dereference in r535_gsp_msgq_recv()
2025-02-17 7:31 [PATCH next] drm/nouveau: Fix error pointer dereference in r535_gsp_msgq_recv() Dan Carpenter
2025-02-17 14:56 ` Zhi Wang
@ 2025-02-19 14:02 ` Danilo Krummrich
1 sibling, 0 replies; 3+ messages in thread
From: Danilo Krummrich @ 2025-02-19 14:02 UTC (permalink / raw)
To: Dan Carpenter
Cc: Zhi Wang, Lyude Paul, David Airlie, Simona Vetter, Timur Tabi,
Dave Airlie, Ben Skeggs, dri-devel, nouveau, linux-kernel,
kernel-janitors
On Mon, Feb 17, 2025 at 10:31:21AM +0300, Dan Carpenter wrote:
> If "rpc" is an error pointer then return directly. Otherwise it leads
> to an error pointer dereference.
>
> Fixes: 50f290053d79 ("drm/nouveau: support handling the return of large GSP message")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Applied to drm-misc-next, thanks!
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-02-19 14:02 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-02-17 7:31 [PATCH next] drm/nouveau: Fix error pointer dereference in r535_gsp_msgq_recv() Dan Carpenter
2025-02-17 14:56 ` Zhi Wang
2025-02-19 14:02 ` Danilo Krummrich
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox