From 9f8d5acfbbcfd617697021ae353b935090eb7b56 Mon Sep 17 00:00:00 2001 From: Sagar Kamble Date: Tue, 21 Apr 2020 17:08:00 +0530 Subject: [PATCH] gpu: nvgpu: fix the return value from gk20a_mm_pin The return value in case of failure of dma_buf_attach and dma_buf_map_attachment was ignored and NULL was returned. This would lead to following null pointer access. Fix it. [ 293.622880] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 ... [ 293.711860] Hardware name: quill (DT) [ 293.720393] pc : nvgpu_linux_sgt_create+0x14/0xa8 [nvgpu] [ 293.725871] lr : nvgpu_vm_map_linux+0x104/0x1c8 [nvgpu] ... [ 293.813934] Call trace: [ 293.816455] nvgpu_linux_sgt_create+0x14/0xa8 [nvgpu] [ 293.821573] nvgpu_vm_map_linux+0x104/0x1c8 [nvgpu] [ 293.826515] nvgpu_vm_map_buffer+0x120/0x290 [nvgpu] [ 293.831542] gk20a_as_dev_ioctl+0x364/0xfb8 [nvgpu] [ 293.836416] ksys_ioctl+0x17c/0xba8 [ 293.839899] __arm64_sys_ioctl+0x18/0x28 [ 293.843817] do_el0_svc+0xf8/0x1b8 [ 293.847214] el0_sync_handler+0x11c/0x28c [ 293.851217] el0_sync+0x140/0x180 Bug 2834141 Change-Id: I0d9e863d0326946c8091bfb1b907b62b055f7272 Signed-off-by: Sagar Kamble Reviewed-on: https://git-master.nvidia.com/r/c/linux-nvgpu/+/2332204 Tested-by: mobile promotions Reviewed-by: automaticguardword Reviewed-by: Automatic_Commit_Validation_User Reviewed-by: Konsta Holtta Reviewed-by: Debarshi Dutta Reviewed-by: Vijayakumar Subbu Reviewed-by: mobile promotions GVS: Gerrit_Virtual_Submit --- drivers/gpu/nvgpu/os/linux/dmabuf.c | 9 +++++++-- drivers/gpu/nvgpu/os/linux/dmabuf_priv.c | 9 +++++++-- 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/nvgpu/os/linux/dmabuf.c b/drivers/gpu/nvgpu/os/linux/dmabuf.c index 69afddc66..c3d00b673 100644 --- a/drivers/gpu/nvgpu/os/linux/dmabuf.c +++ b/drivers/gpu/nvgpu/os/linux/dmabuf.c @@ -66,17 +66,22 @@ struct sg_table *gk20a_mm_pin(struct device *dev, struct dma_buf *dmabuf, return gk20a_mm_pin_has_drvdata(dev, dmabuf, attachment); #else struct dma_buf_attachment *attach = NULL; + struct gk20a *g = get_gk20a(dev); struct sg_table *sgt = NULL; attach = dma_buf_attach(dmabuf, dev); if (IS_ERR(attach)) { - return NULL; + nvgpu_err(g, "Failed to attach dma_buf (err = %ld)!", + PTR_ERR(attach)); + return ERR_CAST(attach); } sgt = dma_buf_map_attachment(attach, DMA_BIDIRECTIONAL); if (IS_ERR(sgt)) { dma_buf_detach(dmabuf, attach); - return NULL; + nvgpu_err(g, "Failed to map attachment (err = %ld)!", + PTR_ERR(sgt)); + return ERR_CAST(sgt); } *attachment = attach; diff --git a/drivers/gpu/nvgpu/os/linux/dmabuf_priv.c b/drivers/gpu/nvgpu/os/linux/dmabuf_priv.c index 770c83350..d963e99f6 100644 --- a/drivers/gpu/nvgpu/os/linux/dmabuf_priv.c +++ b/drivers/gpu/nvgpu/os/linux/dmabuf_priv.c @@ -35,6 +35,7 @@ struct sg_table *gk20a_mm_pin_has_drvdata(struct device *dev, struct dma_buf *dmabuf, struct dma_buf_attachment **attachment) { + struct gk20a *g = get_gk20a(dev); struct gk20a_dmabuf_priv *priv; priv = dma_buf_get_drvdata(dmabuf, dev); @@ -49,7 +50,9 @@ struct sg_table *gk20a_mm_pin_has_drvdata(struct device *dev, priv->attach = dma_buf_attach(dmabuf, dev); if (IS_ERR(priv->attach)) { nvgpu_mutex_release(&priv->lock); - return (struct sg_table *)priv->attach; + nvgpu_err(g, "Failed to attach dma_buf (err = %ld)!", + PTR_ERR(priv->attach)); + return ERR_CAST(priv->attach); } priv->sgt = dma_buf_map_attachment(priv->attach, @@ -57,7 +60,9 @@ struct sg_table *gk20a_mm_pin_has_drvdata(struct device *dev, if (IS_ERR(priv->sgt)) { dma_buf_detach(dmabuf, priv->attach); nvgpu_mutex_release(&priv->lock); - return priv->sgt; + nvgpu_err(g, "Failed to map attachment (err = %ld)!", + PTR_ERR(priv->sgt)); + return ERR_CAST(priv->sgt); } }