nv-tegra-mirror/linux-nv-oot
1
0
Fork 0
mirror of git://nv-tegra.nvidia.com/linux-nv-oot.git synced 2025-12-22 09:11:26 +03:00
Code Issues Packages Projects Releases Wiki Activity

video: tegra: nvmap: Fix error pointer dereference

Browse Source 
In nvmap_try_duplicate_by_ivmid(), the return pointer from
nvmap_duplicate_handle() is getting dereferenced without checking
whether the pointer is error or valid. This is causing kernel panic.
Fix this by checking if the return pointer is invalid then return error.

Bug 3766497

Change-Id: I010893c9ebda60e313c4f776044a123073399ef2
Signed-off-by: Ashish Mhetre <amhetre@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nvidia/+/2846180
Reviewed-by: svcacv <svcacv@nvidia.com>
Reviewed-by: Ketan Patil <ketanp@nvidia.com>
Reviewed-by: svc-mobile-coverity <svc-mobile-coverity@nvidia.com>
Reviewed-by: svc-mobile-cert <svc-mobile-cert@nvidia.com>
Reviewed-by: svc_kernel_abi <svc_kernel_abi@nvidia.com>
Reviewed-by: Sachin Nikam <snikam@nvidia.com>
GVS: Gerrit_Virtual_Submit <buildbot_gerritrpt@nvidia.com>
This commit is contained in:
Ashish Mhetre
2023-01-19 09:16:51 +00:00
committed by Laxman Dewangan
parent afb7cce70c
commit ae282d2c22
2 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/video/tegra/nvmap/nvmap_handle.c
View File

@@ -3,7 +3,7 @@
*
* Handle allocation and freeing routines for nvmap
*
* Copyright (c) 2009-2022, NVIDIA CORPORATION. All rights reserved.
* Copyright (c) 2009-2023, NVIDIA CORPORATION. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify it
* under the terms and conditions of the GNU General Public License,
@@ -339,6 +339,10 @@ found:
/* h->dmabuf can't be NULL anymore. Duplicate the handle. */
ref = nvmap_duplicate_handle(client, h, true, false);
if (IS_ERR_OR_NULL(ref)) {
pr_err("Failed to duplicate handle\n");
return ref;
}
/* put the extra ref taken using get_dma_buf. */
dma_buf_put(h->dmabuf);
finish:

4
drivers/video/tegra/nvmap/nvmap_ioctl.c
View File

@@ -3,7 +3,7 @@
*
* User-space interface to nvmap
*
* Copyright (c) 2011-2022, NVIDIA CORPORATION. All rights reserved.
* Copyright (c) 2011-2023, NVIDIA CORPORATION. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify it
* under the terms and conditions of the GNU General Public License,
@@ -764,7 +764,7 @@ int nvmap_ioctl_create_from_ivc(struct file *filp, void __user *arg)
return -ENODEV;
ref = nvmap_try_duplicate_by_ivmid(client, op.ivm_id, &block);
if (!ref) {
if (IS_ERR_OR_NULL(ref)) {
/*
* See nvmap_heap_alloc() for encoding details.
*/