admin/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2025-12-07 20:06:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

drm/msm: fix missing NULL check after kcalloc in crashstate_get_bos()

Browse Source 
The crashstate_get_bos() function allocates memory for `state->bos`
using kcalloc(), but the vmbind path does not check for allocation
failure before dereferencing it in the following drm_gpuvm_for_each_va()
loop. This could lead to a NULL pointer dereference if memory allocation
fails.

Fix this by wrapping the drm_gpuvm_for_each_va() loop with a NULL check
on state->bos, similar to the safety check in the non-vmbind path.

Fixes: af9aa6f316 ("drm/msm: Crashdump support for sparse")
Signed-off-by: Huiwen He <hehuiwen@kylinos.cn>
Patchwork: https://patchwork.freedesktop.org/patch/687556/
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
This commit is contained in:
Huiwen He
2025-11-13 01:19:47 +08:00
committed by Rob Clark
parent 3099e0247e
commit 3065e6a4d3
1 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
drivers/gpu/drm/msm/msm_gpu.c
View File

@@ -287,16 +287,17 @@ static void crashstate_get_bos(struct msm_gpu_state *state, struct msm_gem_submi
state->bos = kcalloc(cnt, sizeof(struct msm_gpu_state_bo), GFP_KERNEL);
drm_gpuvm_for_each_va (vma, submit->vm) {
bool dump = rd_full || (vma->flags & MSM_VMA_DUMP);
if (state->bos)
drm_gpuvm_for_each_va(vma, submit->vm) {
bool dump = rd_full || (vma->flags & MSM_VMA_DUMP);
/* Skip MAP_NULL/PRR VMAs: */
if (!vma->gem.obj)
continue;
/* Skip MAP_NULL/PRR VMAs: */
if (!vma->gem.obj)
continue;
msm_gpu_crashstate_get_bo(state, vma->gem.obj, vma->va.addr,
dump, vma->gem.offset, vma->va.range);
}
msm_gpu_crashstate_get_bo(state, vma->gem.obj, vma->va.addr,
dump, vma->gem.offset, vma->va.range);
}
drm_exec_fini(&exec);
} else {