dma-buf/udmabuf: Fix NULL pointer dereference in udmabuf_create
PATCH 1/1 dma-buf/udmabuf: Fix NULL pointer dereference in udmabuf_create
There is a potential execution path in which pointer memfd is NULL when passed as argument to fput(), hence there is a NULL pointer dereference in fput().
Fix this by null checking *memfd* before calling fput().
Addresses-Coverity-ID: 1473174 ("Explicit null dereferenced")
Fixes fbb0de795078 ("Add udmabuf misc device")
Signed-off-by Gustavo A. R. Silva <[email protected]>
--- drivers/dma-buf/udmabuf.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/dma-buf/udmabuf.c +2 -1
@@ -194,7 +194,8 @@ static long udmabuf_create(struct udmabuf_create_list *head,while (pgbuf >0 )put_page (ubuf->pages[--pgbuf]); err_free_ubuf: -fput (memfd); +if (memfd) +fput (memfd);kfree (ubuf->pages);kfree (ubuf);return ret;
Signature · 1 line
2.7.4
Quoted 9 lines · Gustavo A. R. Silva
There is a potential execution path in which pointer memfd is NULL when passed as argument to
fput(), hence there is a NULL pointer dereference infput().Fix this by null checking *memfd* before calling
fput().Addresses-Coverity-ID: 1473174 ("Explicit null dereferenced")
Fixes fbb0de795078 ("Add udmabuf misc device")Signed-off-by Gustavo A. R. Silva <[email protected]>
Pushed to drm-misc-next.
thanks,
Gerd