drm/gma500: Fix potential NULL pointer dereference
Subsystems (3)
PATCH 1/1 drm/gma500: Fix potential NULL pointer dereference
fb is being dereferenced before it is null checked, hence there is a potential null pointer dereference.
Fix this by moving the pointer dereference after fb has been properly null checked at line 74: if (!fb)
Addresses-Coverity-ID: 1470169 ("Dereference before null check")
--- drivers/gpu/drm/gma500/gma_display.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/gma500/gma_display.c +3 -1
@@ -60,7 +60,7 @@ int gma_pipe_set_base(struct drm_crtc *crtc, int x, int y,struct drm_psb_private *dev_priv = dev->dev_private;struct gma_crtc *gma_crtc =to_gma_crtc (crtc);struct drm_framebuffer *fb = crtc->primary->fb; -struct gtt_range *gtt =to_gtt_range (fb->obj[0 ]); +struct gtt_range *gtt;int pipe = gma_crtc->pipe;const struct psb_offset *map = &dev_priv->regmap[pipe];unsigned long start, offset;
@@ -76,6 +76,8 @@ int gma_pipe_set_base(struct drm_crtc *crtc, int x, int y, goto gma_pipe_cleaner; } + gtt =to_gtt_range (fb->obj[0 ]); +/* We are displaying this buffer, make sure it is actually loaded into the GTT */ ret =psb_gtt_pin (gtt);
Signature · 1 line
2.7.4
Quoted 5 lines · Gustavo A. R. Silva
fb is being dereferenced before it is null checked, hence there is a potential null pointer dereference.
Fix this by moving the pointer dereference after fb has been properly null checked at line 74: if (!fb)
I don't remember if set_base w/ fb==NULL is even legal. But as long as the check is there this seems sane. Pushed to drm-misc-next. Thanks for the patch.
Quoted 36 lines
Addresses-Coverity-ID: 1470169 ("Dereference before null check")
Signed-off-by Gustavo A. R. Silva <[email protected]>--- drivers/gpu/drm/gma500/gma_display.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)drivers/gpu/drm/gma500/gma_display.c +3
-1@@ -60,7 +60,7 @@ int gma_pipe_set_base(struct drm_crtc *crtc, int x, int y,struct drm_psb_private *dev_priv = dev->dev_private;struct gma_crtc *gma_crtc =to_gma_crtc (crtc);struct drm_framebuffer *fb = crtc->primary->fb; -struct gtt_range *gtt =to_gtt_range (fb->obj[0 ]); +struct gtt_range *gtt;int pipe = gma_crtc->pipe;const struct psb_offset *map = &dev_priv->regmap[pipe];unsigned long start, offset;@@ -76,6 +76,8 @@ int gma_pipe_set_base(struct drm_crtc *crtc, int x, int y, goto gma_pipe_cleaner; } + gtt =to_gtt_range (fb->obj[0 ]); +/* We are displaying this buffer, make sure it is actually loaded into the GTT */ ret =psb_gtt_pin (gtt);Signature · 6 lines
2.7.4 _______________________________________________ dri-devel mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/dri-devel
Signature · 6 lines
Ville Syrjälä Intel _______________________________________________ dri-devel mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/dri-devel