| Message ID | 20211116114558.GA11936@kili (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | drm/i915: Fix error pointer dereference in i915_gem_do_execbuffer() | expand |
On Tue, Nov 16, 2021 at 02:48:17PM +0300, Dan Carpenter wrote: > Originally "out_fence" was set using out_fence = sync_file_create() but > which returns NULL, but now it is set with out_fence = eb_requests_create() > which returns error pointers. The error path needs to be modified to > avoid an Oops in the "goto err_request;" path. > > Fixes: 544460c33821 ("drm/i915: Multi-BB execbuf") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Thanks for the fix. LGTM. With that: Reviewed-by: Matthew Brost <matthew.brost@intel.com> > --- > drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c | 1 + > 2 files changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c > index 4d7da07442f2..9b24d9b5ade1 100644 > --- a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c > +++ b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c > @@ -3277,6 +3277,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, > out_fence = eb_requests_create(&eb, in_fence, out_fence_fd); > if (IS_ERR(out_fence)) { > err = PTR_ERR(out_fence); > + out_fence = NULL; > if (eb.requests[0]) > goto err_request; > else > -- > 2.20.1 >
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c index 4d7da07442f2..9b24d9b5ade1 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c @@ -3277,6 +3277,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, out_fence = eb_requests_create(&eb, in_fence, out_fence_fd); if (IS_ERR(out_fence)) { err = PTR_ERR(out_fence); + out_fence = NULL; if (eb.requests[0]) goto err_request; else
Originally "out_fence" was set using out_fence = sync_file_create() but which returns NULL, but now it is set with out_fence = eb_requests_create() which returns error pointers. The error path needs to be modified to avoid an Oops in the "goto err_request;" path. Fixes: 544460c33821 ("drm/i915: Multi-BB execbuf") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c | 1 + 2 files changed, 2 insertions(+), 1 deletion(-)