* [PATCH linux-next] drm/radeon: Avoid NULL pointer dereference from atom_index_iio() allocation failure
@ 2013-02-11 21:34 Tim Gardner
2013-02-12 14:07 ` Alex Deucher
0 siblings, 1 reply; 2+ messages in thread
From: Tim Gardner @ 2013-02-11 21:34 UTC (permalink / raw)
To: linux-kernel
Cc: Tim Gardner, David Airlie, Alex Deucher, Michel Dänzer,
Dave Airlie, Christian König, Jerome Glisse, dri-devel
Smatch anlysis:
drivers/gpu/drm/radeon/atom.c:1242 atom_index_iio() error: potential null
dereference 'ctx->iio'. (kzalloc returns null)
Also cleaned up some checks before calls to kfree(). kfree(NULL) is OK.
Cc: David Airlie <airlied@linux.ie>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: "Michel Dänzer" <michel.daenzer@amd.com>
Cc: Dave Airlie <airlied@redhat.com>
Cc: "Christian König" <christian.koenig@amd.com>
Cc: Jerome Glisse <jglisse@redhat.com>
Cc: dri-devel@lists.freedesktop.org
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
---
drivers/gpu/drm/radeon/atom.c | 9 +++++++--
drivers/gpu/drm/radeon/radeon_device.c | 9 ++++++++-
2 files changed, 15 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
index 5ce9bf5..46a9c37 100644
--- a/drivers/gpu/drm/radeon/atom.c
+++ b/drivers/gpu/drm/radeon/atom.c
@@ -1238,6 +1238,8 @@ static int atom_iio_len[] = { 1, 2, 3, 3, 3, 3, 4, 4, 4, 3 };
static void atom_index_iio(struct atom_context *ctx, int base)
{
ctx->iio = kzalloc(2 * 256, GFP_KERNEL);
+ if (!ctx->iio)
+ return;
while (CU8(base) == ATOM_IIO_START) {
ctx->iio[CU8(base + 1)] = base + 2;
base += 2;
@@ -1287,6 +1289,10 @@ struct atom_context *atom_parse(struct card_info *card, void *bios)
ctx->cmd_table = CU16(base + ATOM_ROM_CMD_PTR);
ctx->data_table = CU16(base + ATOM_ROM_DATA_PTR);
atom_index_iio(ctx, CU16(ctx->data_table + ATOM_DATA_IIO_PTR) + 4);
+ if (!ctx->iio) {
+ atom_destroy(ctx);
+ return NULL;
+ }
str = CSTR(CU16(base + ATOM_ROM_MSG_PTR));
while (*str && ((*str == '\n') || (*str == '\r')))
@@ -1335,8 +1341,7 @@ int atom_asic_init(struct atom_context *ctx)
void atom_destroy(struct atom_context *ctx)
{
- if (ctx->iio)
- kfree(ctx->iio);
+ kfree(ctx->iio);
kfree(ctx);
}
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 8794de1..44b8034 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -759,6 +759,11 @@ int radeon_atombios_init(struct radeon_device *rdev)
atom_card_info->pll_write = cail_pll_write;
rdev->mode_info.atom_context = atom_parse(atom_card_info, rdev->bios);
+ if (!rdev->mode_info.atom_context) {
+ radeon_atombios_fini(rdev);
+ return -ENOMEM;
+ }
+
mutex_init(&rdev->mode_info.atom_context->mutex);
radeon_atom_initialize_bios_scratch_regs(rdev->ddev);
atom_allocate_fb_scratch(rdev->mode_info.atom_context);
@@ -778,9 +783,11 @@ void radeon_atombios_fini(struct radeon_device *rdev)
{
if (rdev->mode_info.atom_context) {
kfree(rdev->mode_info.atom_context->scratch);
- kfree(rdev->mode_info.atom_context);
}
+ kfree(rdev->mode_info.atom_context);
+ rdev->mode_info.atom_context = NULL;
kfree(rdev->mode_info.atom_card_info);
+ rdev->mode_info.atom_card_info = NULL;
}
/* COMBIOS */
--
1.7.9.5
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH linux-next] drm/radeon: Avoid NULL pointer dereference from atom_index_iio() allocation failure
2013-02-11 21:34 [PATCH linux-next] drm/radeon: Avoid NULL pointer dereference from atom_index_iio() allocation failure Tim Gardner
@ 2013-02-12 14:07 ` Alex Deucher
0 siblings, 0 replies; 2+ messages in thread
From: Alex Deucher @ 2013-02-12 14:07 UTC (permalink / raw)
To: Tim Gardner
Cc: linux-kernel, Michel Dänzer, dri-devel, Jerome Glisse,
Alex Deucher, Dave Airlie, Christian König
On Mon, Feb 11, 2013 at 4:34 PM, Tim Gardner <tim.gardner@canonical.com> wrote:
> Smatch anlysis:
>
> drivers/gpu/drm/radeon/atom.c:1242 atom_index_iio() error: potential null
> dereference 'ctx->iio'. (kzalloc returns null)
>
> Also cleaned up some checks before calls to kfree(). kfree(NULL) is OK.
>
> Cc: David Airlie <airlied@linux.ie>
> Cc: Alex Deucher <alexander.deucher@amd.com>
> Cc: "Michel Dänzer" <michel.daenzer@amd.com>
> Cc: Dave Airlie <airlied@redhat.com>
> Cc: "Christian König" <christian.koenig@amd.com>
> Cc: Jerome Glisse <jglisse@redhat.com>
> Cc: dri-devel@lists.freedesktop.org
> Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Applied to my -next tree. thanks!
Alex
> ---
> drivers/gpu/drm/radeon/atom.c | 9 +++++++--
> drivers/gpu/drm/radeon/radeon_device.c | 9 ++++++++-
> 2 files changed, 15 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
> index 5ce9bf5..46a9c37 100644
> --- a/drivers/gpu/drm/radeon/atom.c
> +++ b/drivers/gpu/drm/radeon/atom.c
> @@ -1238,6 +1238,8 @@ static int atom_iio_len[] = { 1, 2, 3, 3, 3, 3, 4, 4, 4, 3 };
> static void atom_index_iio(struct atom_context *ctx, int base)
> {
> ctx->iio = kzalloc(2 * 256, GFP_KERNEL);
> + if (!ctx->iio)
> + return;
> while (CU8(base) == ATOM_IIO_START) {
> ctx->iio[CU8(base + 1)] = base + 2;
> base += 2;
> @@ -1287,6 +1289,10 @@ struct atom_context *atom_parse(struct card_info *card, void *bios)
> ctx->cmd_table = CU16(base + ATOM_ROM_CMD_PTR);
> ctx->data_table = CU16(base + ATOM_ROM_DATA_PTR);
> atom_index_iio(ctx, CU16(ctx->data_table + ATOM_DATA_IIO_PTR) + 4);
> + if (!ctx->iio) {
> + atom_destroy(ctx);
> + return NULL;
> + }
>
> str = CSTR(CU16(base + ATOM_ROM_MSG_PTR));
> while (*str && ((*str == '\n') || (*str == '\r')))
> @@ -1335,8 +1341,7 @@ int atom_asic_init(struct atom_context *ctx)
>
> void atom_destroy(struct atom_context *ctx)
> {
> - if (ctx->iio)
> - kfree(ctx->iio);
> + kfree(ctx->iio);
> kfree(ctx);
> }
>
> diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
> index 8794de1..44b8034 100644
> --- a/drivers/gpu/drm/radeon/radeon_device.c
> +++ b/drivers/gpu/drm/radeon/radeon_device.c
> @@ -759,6 +759,11 @@ int radeon_atombios_init(struct radeon_device *rdev)
> atom_card_info->pll_write = cail_pll_write;
>
> rdev->mode_info.atom_context = atom_parse(atom_card_info, rdev->bios);
> + if (!rdev->mode_info.atom_context) {
> + radeon_atombios_fini(rdev);
> + return -ENOMEM;
> + }
> +
> mutex_init(&rdev->mode_info.atom_context->mutex);
> radeon_atom_initialize_bios_scratch_regs(rdev->ddev);
> atom_allocate_fb_scratch(rdev->mode_info.atom_context);
> @@ -778,9 +783,11 @@ void radeon_atombios_fini(struct radeon_device *rdev)
> {
> if (rdev->mode_info.atom_context) {
> kfree(rdev->mode_info.atom_context->scratch);
> - kfree(rdev->mode_info.atom_context);
> }
> + kfree(rdev->mode_info.atom_context);
> + rdev->mode_info.atom_context = NULL;
> kfree(rdev->mode_info.atom_card_info);
> + rdev->mode_info.atom_card_info = NULL;
> }
>
> /* COMBIOS */
> --
> 1.7.9.5
>
> _______________________________________________
> dri-devel mailing list
> dri-devel@lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2013-02-12 14:08 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-02-11 21:34 [PATCH linux-next] drm/radeon: Avoid NULL pointer dereference from atom_index_iio() allocation failure Tim Gardner
2013-02-12 14:07 ` Alex Deucher
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).