From patchwork Wed Jun 14 23:18:28 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Osipenko X-Patchwork-Id: 9787747 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 9A5B6602CB for ; Thu, 15 Jun 2017 00:59:05 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 90850284E4 for ; Thu, 15 Jun 2017 00:59:05 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 84B60284F5; Thu, 15 Jun 2017 00:59:05 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_MED, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 22180284E4 for ; Thu, 15 Jun 2017 00:59:05 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id D79826E67A; Thu, 15 Jun 2017 00:57:44 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-lf0-x241.google.com (mail-lf0-x241.google.com [IPv6:2a00:1450:4010:c07::241]) by gabe.freedesktop.org (Postfix) with ESMTPS id B59446E632 for ; Wed, 14 Jun 2017 23:19:01 +0000 (UTC) Received: by mail-lf0-x241.google.com with SMTP id x81so1602403lfb.3 for ; Wed, 14 Jun 2017 16:19:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :in-reply-to:references; bh=sjR7qmYfEZlj/3DpaMGepA967s87BpRjg3mbF2TFzP8=; b=vfrVg5QAWjluFcfnIhgwpSyhoSP2Ixxr6cYrx0UyEtrr/kxnApvFAhpcUm96o2Mk6i NXfV00efGZof7aauE5sBwCCPinra4oUrV3cZgxs3kD7cQ8ghFDsb94iFEJ4ZOpJicTPH 83aYAn3AsKQd3CbDUpu0RkKv6OhouzYaRrEFC1DYFp+MQ4ICsYWFnHKRbhYEQ7o7qyEF lsZ0W+bfYNxPW18YnNTCfB3pMtm1hwcJF5TFZ/ED22c/nmJgMgevM3xkdgJ8T8+/HGGd nNQqbD4Gwk7mJTnoawpr7S4ZRGYDkZ4nOCHv+TyL27GerZbR3Zo1KykQr7Eaml1a9Odb rN5g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:in-reply-to:references; bh=sjR7qmYfEZlj/3DpaMGepA967s87BpRjg3mbF2TFzP8=; b=DvSl27ezD39jkYgIJtyATflz89yG7iajK1iYN+IH8Weu5uyx/UicJH+pXebqcHQp7W W1XYVrixY8NWbmTxG85ssvGyS7Ly05S41Nfyn5P3vkMWgA6Zs7PPDrqHwWC3A0/X8Q74 kj2Lyva/ChNdl8xIDfvvOwgbMgOelQMLdJCu+/7hoduONGlDBxDewniVXzvaM/wv76jV KnneN31ruIPCZCEnOpIYpQLmgM1bmnzN0ySUKjJVpVvKRihuZTnCNiWfQ34T4F2XyViW muchtPPtm7cKv/FkGis8F5XRH3SFOboqKheFNZgBxVjo4ve6MwUFlntjm0lJkpxmtLvS Bicw== X-Gm-Message-State: AKS2vOxAvXgpQabCI+mTC4IaDB6g72wpnYzqLUTmjypTiR2jQ7ZOEDIN QtyK4/Oble/YJQ== X-Received: by 10.46.84.28 with SMTP id i28mr719668ljb.44.1497482340170; Wed, 14 Jun 2017 16:19:00 -0700 (PDT) Received: from localhost.localdomain (ppp109-252-91-7.pppoe.spdop.ru. [109.252.91.7]) by smtp.gmail.com with ESMTPSA id i24sm290165ljb.63.2017.06.14.16.18.58 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 14 Jun 2017 16:18:59 -0700 (PDT) From: Dmitry Osipenko To: Thierry Reding , Mikko Perttunen , Erik Faye-Lund Subject: [PATCH v3 05/20] drm/tegra: Check syncpoint ID in the 'submit' IOCTL Date: Thu, 15 Jun 2017 02:18:28 +0300 Message-Id: X-Mailer: git-send-email 2.13.0 In-Reply-To: References: In-Reply-To: References: X-Mailman-Approved-At: Thu, 15 Jun 2017 00:57:20 +0000 Cc: linux-tegra@vger.kernel.org, DRI Development X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP In case of invalid syncpoint ID, the host1x_syncpt_get() returns NULL and none of its users perform a check of the returned pointer later. Let's bail out until it's too late. Signed-off-by: Dmitry Osipenko Reviewed-by: Mikko Perttunen --- drivers/gpu/drm/tegra/drm.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c index b90ed2cd32ce..e999391aedc9 100644 --- a/drivers/gpu/drm/tegra/drm.c +++ b/drivers/gpu/drm/tegra/drm.c @@ -393,6 +393,8 @@ int tegra_drm_submit(struct tegra_drm_context *context, struct drm_tegra_waitchk __user *waitchks = (void __user *)(uintptr_t)args->waitchks; struct drm_tegra_syncpt syncpt; + struct host1x *host1x = dev_get_drvdata(drm->dev->parent); + struct host1x_syncpt *sp; struct host1x_job *job; int err; @@ -522,6 +524,13 @@ int tegra_drm_submit(struct tegra_drm_context *context, goto fail; } + /* check whether syncpoint ID is valid */ + sp = host1x_syncpt_get(host1x, syncpt.id); + if (!sp) { + err = -ENOENT; + goto fail; + } + job->is_addr_reg = context->client->ops->is_addr_reg; job->syncpt_incrs = syncpt.incrs; job->syncpt_id = syncpt.id;