Skip to contentSkip to conversation

drm/savage: dereferencing an error pointer

PATCH In review Dan Carpenter 2 participants 2 messages Oct 12, 2016

Subsystems (3)
DRM drivers DRM misc Kernel janitors
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 drm/savage: dereferencing an error pointer

A recent cleanup changed the kmalloc() + copy_from_user() to memdup_user() but the error handling wasn't updated so we might call kfree(-EFAULT) and crash.

Fixes a6e3918bcdb1 ('GPU-DRM-Savage: Use memdup_user() rather than duplicating')
Signed-off-by Dan Carpenter <[email protected]>
drivers/gpu/drm/savage/savage_state.c +1 -0
index 3dc0d8f..2db89be 100644
@@ -1004,6 +1004,7 @@ int savage_bci_cmdbuf(struct drm_device *dev, void *data, struct drm_file *file_
 		kvb_addr = memdup_user(cmdbuf->vb_addr, cmdbuf->vb_size);
 		if (IS_ERR(kvb_addr)) {
 			ret = PTR_ERR(kvb_addr);
+			kvb_addr = NULL;
 			goto done;
 		}
 		cmdbuf->vb_addr = kvb_addr;
#1 lore raw
Quoted 13 lines

A recent cleanup changed the kmalloc() + copy_from_user() to memdup_user() but the error handling wasn't updated so we might call kfree(-EFAULT) and crash.

Fixes a6e3918bcdb1 ('GPU-DRM-Savage: Use memdup_user() rather than duplicating')
Signed-off-by Dan Carpenter <[email protected]>
drivers/gpu/drm/savage/savage_state.c +0 -0
index 3dc0d8f..2db89be 100644

drivers/gpu/drm/savage/savage_state.c int savage_bci_cmdbuf(struct drm_device *dev, void *data, struct drm_file *file_ · line 1010

Quoted 7 lines
drivers/gpu/drm/savage/savage_state.c +1 -0
@@ -1004,6 +1004,7 @@ int savage_bci_cmdbuf(struct drm_device *dev, void *data, struct drm_file *file_
 		kvb_addr = memdup_user(cmdbuf->vb_addr, cmdbuf->vb_size);
 		if (IS_ERR(kvb_addr)) {
 			ret = PTR_ERR(kvb_addr);
+			kvb_addr = NULL;
 			goto done;
 		}
 		cmdbuf->vb_addr = kvb_addr;

Thanks for this update suggestion.

Can it be that I offered an other approach for a corresponding software correction by the update step “[PATCH 2/2] GPU-DRM-Savage: Less function calls in savage_bci_cmdbuf() after error detection” (on 2016-08-18)?

https://patchwork.kernel.org/patch/9289183/
https://lkml.kernel.org/r/<[email protected]>

Will this one become worth for further development consideratons once more?

Can the shown resetting of an error pointer to a safe null pointer be omitted in such use cases when the jump targets will be accordingly configured as it is desired for efficient exception handling implementations?

Regards,
Markus
--
To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html