nv-tegra-mirror/linux-nv-oot
1
0
Fork 0
mirror of git://nv-tegra.nvidia.com/linux-nv-oot.git synced 2025-12-22 17:25:35 +03:00
Code Issues Packages Projects Releases Wiki Activity

drm/tegra: gem: Do not try to dereference ERR_PTR()

Browse Source 
When mapping the DMA-BUF attachment fails, map->sgt will be an ERR_PTR-
encoded error code and the cleanup code would try to free that memory,
which obviously would fail.

Zero out that pointer after extracting the error code when this happens
so that kfree() can do the right thing.

Bug 3706991

Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
Change-Id: I6870559061cb91fb6ff01bc458a816f56ce8b978
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nvidia/+/2744243
(cherry picked from commit 9d625d7f7fa2f1769c6f7f856b4ca7562ccba1e6)
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nvidia/+/2744600
Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
GVS: Gerrit_Virtual_Submit
This commit is contained in:
Thierry Reding
2022-05-06 15:52:49 +02:00
committed by Laxman Dewangan
parent 381919e9c3
commit c8eb0cd6b2
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
drivers/gpu/drm/tegra/gem.c
View File

@@ -91,6 +91,7 @@ static struct host1x_bo_mapping *tegra_bo_pin(struct device *dev, struct host1x_
if (IS_ERR(map->sgt)) { if (IS_ERR(map->sgt)) {
dma_buf_detach(buf, map->attach); dma_buf_detach(buf, map->attach);
err = PTR_ERR(map->sgt); err = PTR_ERR(map->sgt);
map->sgt = NULL;
goto free; goto free;
} }