From patchwork Tue Aug 12 03:30:32 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Xiubo Li X-Patchwork-Id: 4715711 Return-Path: X-Original-To: patchwork-dri-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork2.web.kernel.org (Postfix) with ESMTP id C7B3DC0338 for ; Wed, 13 Aug 2014 01:01:02 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 037202018B for ; Wed, 13 Aug 2014 01:01:02 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by mail.kernel.org (Postfix) with ESMTP id 5D70D20166 for ; Wed, 13 Aug 2014 01:00:59 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id DB70D89219; Tue, 12 Aug 2014 18:00:56 -0700 (PDT) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from na01-bl2-obe.outbound.protection.outlook.com (mail-bl2lp0211.outbound.protection.outlook.com [207.46.163.211]) by gabe.freedesktop.org (Postfix) with ESMTP id 16AFE6E02E for ; Mon, 11 Aug 2014 20:50:18 -0700 (PDT) Received: from BN3PR0301CA0054.namprd03.prod.outlook.com (25.160.152.150) by DM2PR0301MB0622.namprd03.prod.outlook.com (25.160.95.26) with Microsoft SMTP Server (TLS) id 15.0.1005.10; Tue, 12 Aug 2014 03:34:49 +0000 Received: from BY2FFO11FD008.protection.gbl (2a01:111:f400:7c0c::171) by BN3PR0301CA0054.outlook.office365.com (2a01:111:e400:401e::22) with Microsoft SMTP Server (TLS) id 15.0.1005.10 via Frontend Transport; Tue, 12 Aug 2014 03:34:48 +0000 Received: from tx30smr01.am.freescale.net (192.88.168.50) by BY2FFO11FD008.mail.protection.outlook.com (10.1.14.159) with Microsoft SMTP Server (TLS) id 15.0.1010.11 via Frontend Transport; Tue, 12 Aug 2014 03:34:48 +0000 Received: from titan.ap.freescale.net ([10.192.208.233]) by tx30smr01.am.freescale.net (8.14.3/8.14.0) with ESMTP id s7C3Yadt027875; Mon, 11 Aug 2014 20:34:46 -0700 From: Xiubo Li To: , Subject: [PATCH 2/3] drm/crtc: Fix possible ZERO_SIZE_PTR pointer dereferencing error. Date: Tue, 12 Aug 2014 11:30:32 +0800 Message-ID: <1407814233-43689-3-git-send-email-Li.Xiubo@freescale.com> X-Mailer: git-send-email 1.8.5 In-Reply-To: <1407814233-43689-1-git-send-email-Li.Xiubo@freescale.com> References: <1407814233-43689-1-git-send-email-Li.Xiubo@freescale.com> X-EOPAttributedMessage: 0 X-Forefront-Antispam-Report: CIP:192.88.168.50; CTRY:US; IPV:CAL; IPV:NLI; EFV:NLI; SFV:NSPM; SFS:(6009001)(199003)(189002)(87286001)(4396001)(50226001)(95666004)(74662001)(74502001)(80022001)(47776003)(81342001)(64706001)(104016003)(93916002)(31966008)(44976005)(77982001)(107046002)(79102001)(81542001)(83072002)(46102001)(229853001)(76482001)(84676001)(50466002)(92566001)(20776003)(105606002)(48376002)(19580405001)(92726001)(85852003)(68736004)(87936001)(83322001)(62966002)(19580395003)(6806004)(36756003)(106466001)(21056001)(77156001)(97736001)(85306004)(86362001)(99396002)(88136002)(102836001)(89996001)(76176999)(50986999)(26826002)(104166001); DIR:OUT; SFP:; SCL:1; SRVR:DM2PR0301MB0622; H:tx30smr01.am.freescale.net; FPR:; MLV:ovrnspm; PTR:InfoDomainNonexistent; A:1; MX:1; LANG:en; MIME-Version: 1.0 X-Microsoft-Antispam: BCL:0;PCL:0;RULEID:;UriScan:; X-Forefront-PRVS: 0301360BF5 Received-SPF: Fail (protection.outlook.com: domain of freescale.com does not designate 192.88.168.50 as permitted sender) receiver=protection.outlook.com; client-ip=192.88.168.50; helo=tx30smr01.am.freescale.net; Authentication-Results: spf=fail (sender IP is 192.88.168.50) smtp.mailfrom=Li.Xiubo@freescale.com; X-OriginatorOrg: freescale.com X-Mailman-Approved-At: Tue, 12 Aug 2014 18:00:55 -0700 Cc: Xiubo Li X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Spam-Status: No, score=-4.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Since we cannot make sure the 'total_objects' and 'gamma_size' will always be none zero here, and then if either equals to zero, the kzalloc() will return ZERO_SIZE_PTR, which equals to ((void *)16). This patch fix this with just doing the zero check before calling kzalloc(). Signed-off-by: Xiubo Li --- drivers/gpu/drm/drm_crtc.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c index 901b812..2379c7a 100644 --- a/drivers/gpu/drm/drm_crtc.c +++ b/drivers/gpu/drm/drm_crtc.c @@ -1507,9 +1507,14 @@ static int drm_mode_group_init(struct drm_device *dev, struct drm_mode_group *gr total_objects += dev->mode_config.num_encoder; total_objects += dev->mode_config.num_bridge; - group->id_list = kzalloc(total_objects * sizeof(uint32_t), GFP_KERNEL); - if (!group->id_list) - return -ENOMEM; + if (total_objects) { + group->id_list = kzalloc(total_objects * sizeof(uint32_t), + GFP_KERNEL); + if (!group->id_list) + return -ENOMEM; + } else { + group->id_list = NULL; + } group->num_crtcs = 0; group->num_connectors = 0; @@ -4337,6 +4342,9 @@ EXPORT_SYMBOL(drm_mode_connector_attach_encoder); int drm_mode_crtc_set_gamma_size(struct drm_crtc *crtc, int gamma_size) { + if (!gamma_size) + return -EINVAL; + crtc->gamma_size = gamma_size; crtc->gamma_store = kzalloc(gamma_size * sizeof(uint16_t) * 3, GFP_KERNEL);