From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x226tzoC7n1QcLjdtubOi3y3HsU0AwINcCm6d4pCNPKbHO2aPN2ZxlDQlZFITNKpGwCA8q9LY ARC-Seal: i=1; a=rsa-sha256; t=1517256962; cv=none; d=google.com; s=arc-20160816; b=EBtFfFIPlGLp2Dv69yp9R1aqcPtbzSVyRUBw7hI2pw9mp6D8ljcXxVSvuoPJvtP+o3 PLsiJEa9abkGokC2QrEe/OUPJU3JSKDejRsOa9cMFX1L1DTKdXgY1tHF+ffrU0IUzMuG fCLXrEX2fQwEooPIiPu+Jq2WELbg0NpzvuiVwxe1n9LBHClY/DRkWFFzKhHlJUH6pfDx yOfkVbRh2/g5gp81lf1rb60gFfrWJNFmshNg91MB4qsOsYXg9gwCSbmXC213XShfeWUJ l54lY72bzHOqJ9rokWI3UUDPyuDdIekrJ9dFCYR4+tDU4W/ng1eQaiumeQO/Ak+/XA5h MVvQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:user-agent:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=PVLSnP6qp4rPcPJwHpNj4N5WBiMhvBtdoxZxzmYfY9U=; b=CMVcJgldsv7m/iNVS2xUiytG0lUJaZZCAUh0+V2hQwptnmj6hcdpnwYNY11ERUfgqf 5C7ieLf3z1lUQcPFlEs6KJoV4KWs6G2/rxnbNk1PUNOKyuKS/ZOUflJ6yk4rvkMxS+LN zzy+GXkeJZR12jG1jKTGifuih6GHtbeV+NWMpqelKtXK5fYlKHqgL+gwNRlcl42qahqa dZVv+14fZdwd+0eithM0KZlRR6KBaKanRYAAxUptuLKHZTug7yFOLP/ZhXjGxqwdEmmo AlTRvbnN5Zc8Tu5R8gemWn9fg+N0qY01umZLfKvZSx8QAiOye1dgSZ2ubEVwlWd5d/7r cwlg== ARC-Authentication-Results: i=1; mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Boris Brezillon , Eric Anholt Subject: [PATCH 4.14 22/71] drm/vc4: Fix NULL pointer dereference in vc4_save_hang_state() Date: Mon, 29 Jan 2018 13:56:50 +0100 Message-Id: <20180129123828.774467941@linuxfoundation.org> X-Mailer: git-send-email 2.16.1 In-Reply-To: <20180129123827.271171825@linuxfoundation.org> References: <20180129123827.271171825@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-LABELS: =?utf-8?b?IlxcU2VudCI=?= X-GMAIL-THRID: =?utf-8?q?1590959236329659575?= X-GMAIL-MSGID: =?utf-8?q?1590959236329659575?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Boris Brezillon commit 17b11b76b87afe9f8be199d7a5f442497133e2b0 upstream. When saving BOs in the hang state we skip one entry of the kernel_state->bo[] array, thus leaving it to NULL. This leads to a NULL pointer dereference when, later in this function, we iterate over all BOs to check their ->madv state. Fixes: ca26d28bbaa3 ("drm/vc4: improve throughput by pipelining binning and rendering jobs") Signed-off-by: Boris Brezillon Signed-off-by: Eric Anholt Reviewed-by: Eric Anholt Link: https://patchwork.freedesktop.org/patch/msgid/20180118145821.22344-1-boris.brezillon@free-electrons.com Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/vc4/vc4_gem.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) --- a/drivers/gpu/drm/vc4/vc4_gem.c +++ b/drivers/gpu/drm/vc4/vc4_gem.c @@ -146,7 +146,7 @@ vc4_save_hang_state(struct drm_device *d struct vc4_exec_info *exec[2]; struct vc4_bo *bo; unsigned long irqflags; - unsigned int i, j, unref_list_count, prev_idx; + unsigned int i, j, k, unref_list_count; kernel_state = kcalloc(1, sizeof(*kernel_state), GFP_KERNEL); if (!kernel_state) @@ -182,24 +182,24 @@ vc4_save_hang_state(struct drm_device *d return; } - prev_idx = 0; + k = 0; for (i = 0; i < 2; i++) { if (!exec[i]) continue; for (j = 0; j < exec[i]->bo_count; j++) { drm_gem_object_get(&exec[i]->bo[j]->base); - kernel_state->bo[j + prev_idx] = &exec[i]->bo[j]->base; + kernel_state->bo[k++] = &exec[i]->bo[j]->base; } list_for_each_entry(bo, &exec[i]->unref_list, unref_head) { drm_gem_object_get(&bo->base.base); - kernel_state->bo[j + prev_idx] = &bo->base.base; - j++; + kernel_state->bo[k++] = &bo->base.base; } - prev_idx = j + 1; } + WARN_ON_ONCE(k != state->bo_count); + if (exec[0]) state->start_bin = exec[0]->ct0ca; if (exec[1])