Commit fcbc451b authored by Pauli Nieminen's avatar Pauli Nieminen Committed by Dave Airlie

drm/radeon/kms: Fix NULL pointer dereference if memory allocation failed.

When there is allocation failure in radeon_cs_parser_relocs parser->nrelocs
is not cleaned. This causes NULL pointer defeference in radeon_cs_parser_fini
when clean up code is trying to loop over the relocation array and free the
objects.

Fix adds a check for a possible NULL pointer in clean up code.
Signed-off-by: default avatarPauli Nieminen <suokkos@gmail.com>
Cc: stable@kernel.org
Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
parent f9274562
...@@ -193,10 +193,12 @@ static void radeon_cs_parser_fini(struct radeon_cs_parser *parser, int error) ...@@ -193,10 +193,12 @@ static void radeon_cs_parser_fini(struct radeon_cs_parser *parser, int error)
radeon_bo_list_fence(&parser->validated, parser->ib->fence); radeon_bo_list_fence(&parser->validated, parser->ib->fence);
} }
radeon_bo_list_unreserve(&parser->validated); radeon_bo_list_unreserve(&parser->validated);
if (parser->relocs != NULL) {
for (i = 0; i < parser->nrelocs; i++) { for (i = 0; i < parser->nrelocs; i++) {
if (parser->relocs[i].gobj) if (parser->relocs[i].gobj)
drm_gem_object_unreference_unlocked(parser->relocs[i].gobj); drm_gem_object_unreference_unlocked(parser->relocs[i].gobj);
} }
}
kfree(parser->track); kfree(parser->track);
kfree(parser->relocs); kfree(parser->relocs);
kfree(parser->relocs_ptr); kfree(parser->relocs_ptr);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment