From patchwork Mon Feb 11 21:34:32 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Tim Gardner X-Patchwork-Id: 2127441 Return-Path: X-Original-To: patchwork-dri-devel@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork2.kernel.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by patchwork2.kernel.org (Postfix) with ESMTP id 680BBDFB7B for ; Tue, 12 Feb 2013 06:33:30 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 183C9E5C49 for ; Mon, 11 Feb 2013 22:33:30 -0800 (PST) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org X-Greylist: delayed 1419 seconds by postgrey-1.32 at gabe; Mon, 11 Feb 2013 13:58:22 PST Received: from mail.tpi.com (mail.tpi.com [70.99.223.143]) by gabe.freedesktop.org (Postfix) with ESMTP id 9DB7EE629A for ; Mon, 11 Feb 2013 13:58:22 -0800 (PST) Received: from salmon.rtg.net (mail.tpi.com [70.99.223.143]) by mail.tpi.com (Postfix) with ESMTP id 7ACDC319AC0; Mon, 11 Feb 2013 13:34:38 -0800 (PST) Received: by salmon.rtg.net (Postfix, from userid 1000) id 2D531203BE; Mon, 11 Feb 2013 14:34:38 -0700 (MST) From: Tim Gardner To: linux-kernel@vger.kernel.org Subject: =?UTF-8?q?=5BPATCH=20linux-next=5D=20drm/radeon=3A=20Avoid=20NULL=20pointer=20dereference=20from=20atom=5Findex=5Fiio=28=29=20allocation=20failure?= Date: Mon, 11 Feb 2013 14:34:32 -0700 Message-Id: <1360618472-14821-1-git-send-email-tim.gardner@canonical.com> X-Mailer: git-send-email 1.7.9.5 MIME-Version: 1.0 X-Mailman-Approved-At: Mon, 11 Feb 2013 22:33:18 -0800 Cc: =?UTF-8?q?Michel=20D=C3=A4nzer?= , dri-devel@lists.freedesktop.org, Jerome Glisse , Alex Deucher , Dave Airlie , Tim Gardner , =?UTF-8?q?Christian=20K=C3=B6nig?= X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.13 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: dri-devel-bounces+patchwork-dri-devel=patchwork.kernel.org@lists.freedesktop.org Errors-To: dri-devel-bounces+patchwork-dri-devel=patchwork.kernel.org@lists.freedesktop.org Smatch anlysis: drivers/gpu/drm/radeon/atom.c:1242 atom_index_iio() error: potential null dereference 'ctx->iio'. (kzalloc returns null) Also cleaned up some checks before calls to kfree(). kfree(NULL) is OK. Cc: David Airlie Cc: Alex Deucher Cc: "Michel Dänzer" Cc: Dave Airlie Cc: "Christian König" Cc: Jerome Glisse Cc: dri-devel@lists.freedesktop.org Signed-off-by: Tim Gardner --- drivers/gpu/drm/radeon/atom.c | 9 +++++++-- drivers/gpu/drm/radeon/radeon_device.c | 9 ++++++++- 2 files changed, 15 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c index 5ce9bf5..46a9c37 100644 --- a/drivers/gpu/drm/radeon/atom.c +++ b/drivers/gpu/drm/radeon/atom.c @@ -1238,6 +1238,8 @@ static int atom_iio_len[] = { 1, 2, 3, 3, 3, 3, 4, 4, 4, 3 }; static void atom_index_iio(struct atom_context *ctx, int base) { ctx->iio = kzalloc(2 * 256, GFP_KERNEL); + if (!ctx->iio) + return; while (CU8(base) == ATOM_IIO_START) { ctx->iio[CU8(base + 1)] = base + 2; base += 2; @@ -1287,6 +1289,10 @@ struct atom_context *atom_parse(struct card_info *card, void *bios) ctx->cmd_table = CU16(base + ATOM_ROM_CMD_PTR); ctx->data_table = CU16(base + ATOM_ROM_DATA_PTR); atom_index_iio(ctx, CU16(ctx->data_table + ATOM_DATA_IIO_PTR) + 4); + if (!ctx->iio) { + atom_destroy(ctx); + return NULL; + } str = CSTR(CU16(base + ATOM_ROM_MSG_PTR)); while (*str && ((*str == '\n') || (*str == '\r'))) @@ -1335,8 +1341,7 @@ int atom_asic_init(struct atom_context *ctx) void atom_destroy(struct atom_context *ctx) { - if (ctx->iio) - kfree(ctx->iio); + kfree(ctx->iio); kfree(ctx); } diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c index 8794de1..44b8034 100644 --- a/drivers/gpu/drm/radeon/radeon_device.c +++ b/drivers/gpu/drm/radeon/radeon_device.c @@ -759,6 +759,11 @@ int radeon_atombios_init(struct radeon_device *rdev) atom_card_info->pll_write = cail_pll_write; rdev->mode_info.atom_context = atom_parse(atom_card_info, rdev->bios); + if (!rdev->mode_info.atom_context) { + radeon_atombios_fini(rdev); + return -ENOMEM; + } + mutex_init(&rdev->mode_info.atom_context->mutex); radeon_atom_initialize_bios_scratch_regs(rdev->ddev); atom_allocate_fb_scratch(rdev->mode_info.atom_context); @@ -778,9 +783,11 @@ void radeon_atombios_fini(struct radeon_device *rdev) { if (rdev->mode_info.atom_context) { kfree(rdev->mode_info.atom_context->scratch); - kfree(rdev->mode_info.atom_context); } + kfree(rdev->mode_info.atom_context); + rdev->mode_info.atom_context = NULL; kfree(rdev->mode_info.atom_card_info); + rdev->mode_info.atom_card_info = NULL; } /* COMBIOS */