Commit 6950e23e authored by Alexey Khoroshilov's avatar Alexey Khoroshilov Committed by Thomas Hellstrom

drm/vmwgfx: avoid null pointer dereference at failure paths

vmw_takedown_otable_base() and vmw_mob_unbind() check for
potential vmw_fifo_reserve() failure and print error message,
but then immediately dereference NULL pointer.

Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
Reviewed-by: default avatarThomas Hellstrom <thellstrom@vmware.com>
parent a34417f6
...@@ -188,18 +188,20 @@ static void vmw_takedown_otable_base(struct vmw_private *dev_priv, ...@@ -188,18 +188,20 @@ static void vmw_takedown_otable_base(struct vmw_private *dev_priv,
bo = otable->page_table->pt_bo; bo = otable->page_table->pt_bo;
cmd = vmw_fifo_reserve(dev_priv, sizeof(*cmd)); cmd = vmw_fifo_reserve(dev_priv, sizeof(*cmd));
if (unlikely(cmd == NULL)) if (unlikely(cmd == NULL)) {
DRM_ERROR("Failed reserving FIFO space for OTable setup.\n"); DRM_ERROR("Failed reserving FIFO space for OTable "
"takedown.\n");
memset(cmd, 0, sizeof(*cmd)); } else {
cmd->header.id = SVGA_3D_CMD_SET_OTABLE_BASE; memset(cmd, 0, sizeof(*cmd));
cmd->header.size = sizeof(cmd->body); cmd->header.id = SVGA_3D_CMD_SET_OTABLE_BASE;
cmd->body.type = type; cmd->header.size = sizeof(cmd->body);
cmd->body.baseAddress = 0; cmd->body.type = type;
cmd->body.sizeInBytes = 0; cmd->body.baseAddress = 0;
cmd->body.validSizeInBytes = 0; cmd->body.sizeInBytes = 0;
cmd->body.ptDepth = SVGA3D_MOBFMT_INVALID; cmd->body.validSizeInBytes = 0;
vmw_fifo_commit(dev_priv, sizeof(*cmd)); cmd->body.ptDepth = SVGA3D_MOBFMT_INVALID;
vmw_fifo_commit(dev_priv, sizeof(*cmd));
}
if (bo) { if (bo) {
int ret; int ret;
...@@ -562,11 +564,12 @@ void vmw_mob_unbind(struct vmw_private *dev_priv, ...@@ -562,11 +564,12 @@ void vmw_mob_unbind(struct vmw_private *dev_priv,
if (unlikely(cmd == NULL)) { if (unlikely(cmd == NULL)) {
DRM_ERROR("Failed reserving FIFO space for Memory " DRM_ERROR("Failed reserving FIFO space for Memory "
"Object unbinding.\n"); "Object unbinding.\n");
} else {
cmd->header.id = SVGA_3D_CMD_DESTROY_GB_MOB;
cmd->header.size = sizeof(cmd->body);
cmd->body.mobid = mob->id;
vmw_fifo_commit(dev_priv, sizeof(*cmd));
} }
cmd->header.id = SVGA_3D_CMD_DESTROY_GB_MOB;
cmd->header.size = sizeof(cmd->body);
cmd->body.mobid = mob->id;
vmw_fifo_commit(dev_priv, sizeof(*cmd));
if (bo) { if (bo) {
vmw_fence_single_bo(bo, NULL); vmw_fence_single_bo(bo, NULL);
ttm_bo_unreserve(bo); ttm_bo_unreserve(bo);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment