From patchwork Tue Jun 13 23:15:44 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Osipenko X-Patchwork-Id: 9785095 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 51BC060384 for ; Wed, 14 Jun 2017 00:43:13 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 44A7328567 for ; Wed, 14 Jun 2017 00:43:13 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 393F428573; Wed, 14 Jun 2017 00:43:13 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_MED, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id BADB628567 for ; Wed, 14 Jun 2017 00:43:12 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 8F8AD6E3EC; Wed, 14 Jun 2017 00:41:32 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-lf0-x243.google.com (mail-lf0-x243.google.com [IPv6:2a00:1450:4010:c07::243]) by gabe.freedesktop.org (Postfix) with ESMTPS id 63D2C6E3C9 for ; Tue, 13 Jun 2017 23:38:49 +0000 (UTC) Received: by mail-lf0-x243.google.com with SMTP id o28so14872781lfk.1 for ; Tue, 13 Jun 2017 16:38:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :in-reply-to:references; bh=sjR7qmYfEZlj/3DpaMGepA967s87BpRjg3mbF2TFzP8=; b=aG+H6buZ7I6AU7mYVCAEwa692rjdHAsvwqFcvrrh8p+iXoCXe1gsXxkeFduLYOCGN0 8vejQIJEfa/o7gS96ftILYjnOdyqTGFkwjufCArIFiAxx3JIG8HjyiQOzCSeX/wA/KPV XL4QLYn8dxKEoFCO8sraZrnjBHS+Q0Nbv9FDv3B4kDinscsDCR3j305Yy7TFe2Pj9zzn xaT3SF87zN+Zj6ZbLKPF6wDBcEdt4lOXtE5/9D1XPhmXrSd9yFZwVJy9m7XvBLG9rECL WeqLinmHL2reOvvzGuo3ap07midfrlCDsygcLb1aPD493B29g3B28ncBwM/0EEdHJnJW IcQw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:in-reply-to:references; bh=sjR7qmYfEZlj/3DpaMGepA967s87BpRjg3mbF2TFzP8=; b=uTLTFWpMG1Y6XEo3o0t6uXSNn82D0kBlZgsz7iQVwvIiSlcEWBidfi4cy0/ZE5Tp4r M722kmX4baS56bW7JQPhkOY9dbXELDB6ZLPht6D1QInnXu7OcUqaJ5WvMbDPO+c0Nd3d VWBAXEX+ZUSZxuD9J7WOs1wuMUW47mp1jG3hwOsOjSoRoufU8bZs1ndhowCD/nxGsqIj ub0MjlnDDGe1Mx4xHDlNmqGnh7B5WudO2/9I2Zub+TGkr/HemFswbnNN1OneHXF/hfM6 cfrVhXzS2KMQlOBVhElMWwq3edx9pvzrp12bBg7EQLstHHO1L9OIBjduG1BWSC+S+H/P 7f7w== X-Gm-Message-State: AKS2vOxoTydHIi4pniEniwDLd4uWsMq3TX2QrT2h+WKp7zDIAFgb2Nvy N3QwPAqbFFWG5A== X-Received: by 10.46.21.15 with SMTP id s15mr719534ljd.2.1497397127857; Tue, 13 Jun 2017 16:38:47 -0700 (PDT) Received: from localhost.localdomain (ppp109-252-91-7.pppoe.spdop.ru. [109.252.91.7]) by smtp.gmail.com with ESMTPSA id f27sm3785725lfa.27.2017.06.13.16.38.46 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 13 Jun 2017 16:38:47 -0700 (PDT) From: Dmitry Osipenko To: Thierry Reding , Mikko Perttunen , Erik Faye-Lund Subject: [PATCH v2 05/22] drm/tegra: Check syncpoint ID in the 'submit' IOCTL Date: Wed, 14 Jun 2017 02:15:44 +0300 Message-Id: <746d938d97c43e1b80f448c00e27a04188b01332.1497394243.git.digetx@gmail.com> X-Mailer: git-send-email 2.13.0 In-Reply-To: References: In-Reply-To: References: X-Mailman-Approved-At: Wed, 14 Jun 2017 00:41:00 +0000 Cc: linux-tegra@vger.kernel.org, DRI Development X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP In case of invalid syncpoint ID, the host1x_syncpt_get() returns NULL and none of its users perform a check of the returned pointer later. Let's bail out until it's too late. Signed-off-by: Dmitry Osipenko Reviewed-by: Mikko Perttunen --- drivers/gpu/drm/tegra/drm.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c index b90ed2cd32ce..e999391aedc9 100644 --- a/drivers/gpu/drm/tegra/drm.c +++ b/drivers/gpu/drm/tegra/drm.c @@ -393,6 +393,8 @@ int tegra_drm_submit(struct tegra_drm_context *context, struct drm_tegra_waitchk __user *waitchks = (void __user *)(uintptr_t)args->waitchks; struct drm_tegra_syncpt syncpt; + struct host1x *host1x = dev_get_drvdata(drm->dev->parent); + struct host1x_syncpt *sp; struct host1x_job *job; int err; @@ -522,6 +524,13 @@ int tegra_drm_submit(struct tegra_drm_context *context, goto fail; } + /* check whether syncpoint ID is valid */ + sp = host1x_syncpt_get(host1x, syncpt.id); + if (!sp) { + err = -ENOENT; + goto fail; + } + job->is_addr_reg = context->client->ops->is_addr_reg; job->syncpt_incrs = syncpt.incrs; job->syncpt_id = syncpt.id;