aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorBoris Brezillon <boris.brezillon@free-electrons.com>2018-01-18 09:58:21 -0500
committerEric Anholt <eric@anholt.net>2018-01-18 15:17:03 -0500
commit17b11b76b87afe9f8be199d7a5f442497133e2b0 (patch)
treea664338716ad69536f4330670b8ffee74e6916e8
parentf61145f1a4bd7966aa0b15c5cd3950835b284f55 (diff)
drm/vc4: Fix NULL pointer dereference in vc4_save_hang_state()
When saving BOs in the hang state we skip one entry of the kernel_state->bo[] array, thus leaving it to NULL. This leads to a NULL pointer dereference when, later in this function, we iterate over all BOs to check their ->madv state. Fixes: ca26d28bbaa3 ("drm/vc4: improve throughput by pipelining binning and rendering jobs") Cc: <stable@vger.kernel.org> Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com> Signed-off-by: Eric Anholt <eric@anholt.net> Reviewed-by: Eric Anholt <eric@anholt.net> Link: https://patchwork.freedesktop.org/patch/msgid/20180118145821.22344-1-boris.brezillon@free-electrons.com
-rw-r--r--drivers/gpu/drm/vc4/vc4_gem.c12
1 files changed, 6 insertions, 6 deletions
diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c
index e3e868cdee79..c94cce96544c 100644
--- a/drivers/gpu/drm/vc4/vc4_gem.c
+++ b/drivers/gpu/drm/vc4/vc4_gem.c
@@ -146,7 +146,7 @@ vc4_save_hang_state(struct drm_device *dev)
146 struct vc4_exec_info *exec[2]; 146 struct vc4_exec_info *exec[2];
147 struct vc4_bo *bo; 147 struct vc4_bo *bo;
148 unsigned long irqflags; 148 unsigned long irqflags;
149 unsigned int i, j, unref_list_count, prev_idx; 149 unsigned int i, j, k, unref_list_count;
150 150
151 kernel_state = kcalloc(1, sizeof(*kernel_state), GFP_KERNEL); 151 kernel_state = kcalloc(1, sizeof(*kernel_state), GFP_KERNEL);
152 if (!kernel_state) 152 if (!kernel_state)
@@ -182,7 +182,7 @@ vc4_save_hang_state(struct drm_device *dev)
182 return; 182 return;
183 } 183 }
184 184
185 prev_idx = 0; 185 k = 0;
186 for (i = 0; i < 2; i++) { 186 for (i = 0; i < 2; i++) {
187 if (!exec[i]) 187 if (!exec[i])
188 continue; 188 continue;
@@ -197,7 +197,7 @@ vc4_save_hang_state(struct drm_device *dev)
197 WARN_ON(!refcount_read(&bo->usecnt)); 197 WARN_ON(!refcount_read(&bo->usecnt));
198 refcount_inc(&bo->usecnt); 198 refcount_inc(&bo->usecnt);
199 drm_gem_object_get(&exec[i]->bo[j]->base); 199 drm_gem_object_get(&exec[i]->bo[j]->base);
200 kernel_state->bo[j + prev_idx] = &exec[i]->bo[j]->base; 200 kernel_state->bo[k++] = &exec[i]->bo[j]->base;
201 } 201 }
202 202
203 list_for_each_entry(bo, &exec[i]->unref_list, unref_head) { 203 list_for_each_entry(bo, &exec[i]->unref_list, unref_head) {
@@ -205,12 +205,12 @@ vc4_save_hang_state(struct drm_device *dev)
205 * because they are naturally unpurgeable. 205 * because they are naturally unpurgeable.
206 */ 206 */
207 drm_gem_object_get(&bo->base.base); 207 drm_gem_object_get(&bo->base.base);
208 kernel_state->bo[j + prev_idx] = &bo->base.base; 208 kernel_state->bo[k++] = &bo->base.base;
209 j++;
210 } 209 }
211 prev_idx = j + 1;
212 } 210 }
213 211
212 WARN_ON_ONCE(k != state->bo_count);
213
214 if (exec[0]) 214 if (exec[0])
215 state->start_bin = exec[0]->ct0ca; 215 state->start_bin = exec[0]->ct0ca;
216 if (exec[1]) 216 if (exec[1])