aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorTim Gardner <tim.gardner@canonical.com>2013-02-11 16:34:32 -0500
committerAlex Deucher <alexander.deucher@amd.com>2013-02-20 08:51:19 -0500
commit0e34d0945ed16aeb72c863be4efe4cd0c62f9c53 (patch)
treeacc055d3c3fd2c4ec2972b7d5d16a729097e670f
parentc944b2abb067130542055666f23409fd5e1afc8e (diff)
drm/radeon: Avoid NULL pointer dereference from atom_index_iio() allocation failure
Smatch anlysis: drivers/gpu/drm/radeon/atom.c:1242 atom_index_iio() error: potential null dereference 'ctx->iio'. (kzalloc returns null) Also cleaned up some checks before calls to kfree(). kfree(NULL) is OK. Cc: David Airlie <airlied@linux.ie> Cc: Alex Deucher <alexander.deucher@amd.com> Cc: "Michel Dänzer" <michel.daenzer@amd.com> Cc: Dave Airlie <airlied@redhat.com> Cc: "Christian König" <christian.koenig@amd.com> Cc: Jerome Glisse <jglisse@redhat.com> Cc: dri-devel@lists.freedesktop.org Signed-off-by: Tim Gardner <tim.gardner@canonical.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-rw-r--r--drivers/gpu/drm/radeon/atom.c9
-rw-r--r--drivers/gpu/drm/radeon/radeon_device.c9
2 files changed, 15 insertions, 3 deletions
diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
index 5ce9bf51a8de..46a9c3772850 100644
--- a/drivers/gpu/drm/radeon/atom.c
+++ b/drivers/gpu/drm/radeon/atom.c
@@ -1238,6 +1238,8 @@ static int atom_iio_len[] = { 1, 2, 3, 3, 3, 3, 4, 4, 4, 3 };
1238static void atom_index_iio(struct atom_context *ctx, int base) 1238static void atom_index_iio(struct atom_context *ctx, int base)
1239{ 1239{
1240 ctx->iio = kzalloc(2 * 256, GFP_KERNEL); 1240 ctx->iio = kzalloc(2 * 256, GFP_KERNEL);
1241 if (!ctx->iio)
1242 return;
1241 while (CU8(base) == ATOM_IIO_START) { 1243 while (CU8(base) == ATOM_IIO_START) {
1242 ctx->iio[CU8(base + 1)] = base + 2; 1244 ctx->iio[CU8(base + 1)] = base + 2;
1243 base += 2; 1245 base += 2;
@@ -1287,6 +1289,10 @@ struct atom_context *atom_parse(struct card_info *card, void *bios)
1287 ctx->cmd_table = CU16(base + ATOM_ROM_CMD_PTR); 1289 ctx->cmd_table = CU16(base + ATOM_ROM_CMD_PTR);
1288 ctx->data_table = CU16(base + ATOM_ROM_DATA_PTR); 1290 ctx->data_table = CU16(base + ATOM_ROM_DATA_PTR);
1289 atom_index_iio(ctx, CU16(ctx->data_table + ATOM_DATA_IIO_PTR) + 4); 1291 atom_index_iio(ctx, CU16(ctx->data_table + ATOM_DATA_IIO_PTR) + 4);
1292 if (!ctx->iio) {
1293 atom_destroy(ctx);
1294 return NULL;
1295 }
1290 1296
1291 str = CSTR(CU16(base + ATOM_ROM_MSG_PTR)); 1297 str = CSTR(CU16(base + ATOM_ROM_MSG_PTR));
1292 while (*str && ((*str == '\n') || (*str == '\r'))) 1298 while (*str && ((*str == '\n') || (*str == '\r')))
@@ -1335,8 +1341,7 @@ int atom_asic_init(struct atom_context *ctx)
1335 1341
1336void atom_destroy(struct atom_context *ctx) 1342void atom_destroy(struct atom_context *ctx)
1337{ 1343{
1338 if (ctx->iio) 1344 kfree(ctx->iio);
1339 kfree(ctx->iio);
1340 kfree(ctx); 1345 kfree(ctx);
1341} 1346}
1342 1347
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 6a36f4b67680..9f02fdd68f51 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -758,6 +758,11 @@ int radeon_atombios_init(struct radeon_device *rdev)
758 atom_card_info->pll_write = cail_pll_write; 758 atom_card_info->pll_write = cail_pll_write;
759 759
760 rdev->mode_info.atom_context = atom_parse(atom_card_info, rdev->bios); 760 rdev->mode_info.atom_context = atom_parse(atom_card_info, rdev->bios);
761 if (!rdev->mode_info.atom_context) {
762 radeon_atombios_fini(rdev);
763 return -ENOMEM;
764 }
765
761 mutex_init(&rdev->mode_info.atom_context->mutex); 766 mutex_init(&rdev->mode_info.atom_context->mutex);
762 radeon_atom_initialize_bios_scratch_regs(rdev->ddev); 767 radeon_atom_initialize_bios_scratch_regs(rdev->ddev);
763 atom_allocate_fb_scratch(rdev->mode_info.atom_context); 768 atom_allocate_fb_scratch(rdev->mode_info.atom_context);
@@ -777,9 +782,11 @@ void radeon_atombios_fini(struct radeon_device *rdev)
777{ 782{
778 if (rdev->mode_info.atom_context) { 783 if (rdev->mode_info.atom_context) {
779 kfree(rdev->mode_info.atom_context->scratch); 784 kfree(rdev->mode_info.atom_context->scratch);
780 kfree(rdev->mode_info.atom_context);
781 } 785 }
786 kfree(rdev->mode_info.atom_context);
787 rdev->mode_info.atom_context = NULL;
782 kfree(rdev->mode_info.atom_card_info); 788 kfree(rdev->mode_info.atom_card_info);
789 rdev->mode_info.atom_card_info = NULL;
783} 790}
784 791
785/* COMBIOS */ 792/* COMBIOS */