| Message ID | 20210813113600.GC30697@kili (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | drm/i915/gt: Potential error pointer dereference in pinned_context() | expand |
On 8/13/21 1:36 PM, Dan Carpenter wrote: > If the intel_engine_create_pinned_context() function returns an error > pointer, then dereferencing "ce" will Oops. Use "vm" instead of > "ce->vm". > > Fixes: cf586021642d ("drm/i915/gt: Pipelined page migration") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > --- > drivers/gpu/drm/i915/gt/intel_migrate.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/i915/gt/intel_migrate.c b/drivers/gpu/drm/i915/gt/intel_migrate.c > index d0a7c934fd3b..1dac21aa7e5c 100644 > --- a/drivers/gpu/drm/i915/gt/intel_migrate.c > +++ b/drivers/gpu/drm/i915/gt/intel_migrate.c > @@ -177,7 +177,7 @@ static struct intel_context *pinned_context(struct intel_gt *gt) > ce = intel_engine_create_pinned_context(engine, vm, SZ_512K, > I915_GEM_HWS_MIGRATE, > &key, "migrate"); > - i915_vm_put(ce->vm); > + i915_vm_put(vm); > return ce; > } > Thanks, Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
On Fri, Aug 13, 2021 at 04:01:06PM +0200, Thomas Hellström wrote: > > On 8/13/21 1:36 PM, Dan Carpenter wrote: > > If the intel_engine_create_pinned_context() function returns an error > > pointer, then dereferencing "ce" will Oops. Use "vm" instead of > > "ce->vm". > > > > Fixes: cf586021642d ("drm/i915/gt: Pipelined page migration") > > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > > --- > > drivers/gpu/drm/i915/gt/intel_migrate.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/drivers/gpu/drm/i915/gt/intel_migrate.c b/drivers/gpu/drm/i915/gt/intel_migrate.c > > index d0a7c934fd3b..1dac21aa7e5c 100644 > > --- a/drivers/gpu/drm/i915/gt/intel_migrate.c > > +++ b/drivers/gpu/drm/i915/gt/intel_migrate.c > > @@ -177,7 +177,7 @@ static struct intel_context *pinned_context(struct intel_gt *gt) > > ce = intel_engine_create_pinned_context(engine, vm, SZ_512K, > > I915_GEM_HWS_MIGRATE, > > &key, "migrate"); > > - i915_vm_put(ce->vm); > > + i915_vm_put(vm); > > return ce; > > } > > Thanks, > > Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> And pushed to drm-intel-gt-next, thanks for the patch and review. > >
diff --git a/drivers/gpu/drm/i915/gt/intel_migrate.c b/drivers/gpu/drm/i915/gt/intel_migrate.c index d0a7c934fd3b..1dac21aa7e5c 100644 --- a/drivers/gpu/drm/i915/gt/intel_migrate.c +++ b/drivers/gpu/drm/i915/gt/intel_migrate.c @@ -177,7 +177,7 @@ static struct intel_context *pinned_context(struct intel_gt *gt) ce = intel_engine_create_pinned_context(engine, vm, SZ_512K, I915_GEM_HWS_MIGRATE, &key, "migrate"); - i915_vm_put(ce->vm); + i915_vm_put(vm); return ce; }
If the intel_engine_create_pinned_context() function returns an error pointer, then dereferencing "ce" will Oops. Use "vm" instead of "ce->vm". Fixes: cf586021642d ("drm/i915/gt: Pipelined page migration") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- drivers/gpu/drm/i915/gt/intel_migrate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)