From patchwork Tue May 23 00:14:21 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Osipenko X-Patchwork-Id: 9741631 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id AD1B060388 for ; Tue, 23 May 2017 00:59:53 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A2201286EC for ; Tue, 23 May 2017 00:59:53 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 9710628779; Tue, 23 May 2017 00:59:53 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_MED, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 62980286EC for ; Tue, 23 May 2017 00:59:53 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id E8C0C6E2DA; Tue, 23 May 2017 00:59:39 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-lf0-x241.google.com (mail-lf0-x241.google.com [IPv6:2a00:1450:4010:c07::241]) by gabe.freedesktop.org (Postfix) with ESMTPS id 6CE0289D63 for ; Tue, 23 May 2017 00:15:22 +0000 (UTC) Received: by mail-lf0-x241.google.com with SMTP id m18so6671181lfj.0 for ; Mon, 22 May 2017 17:15:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :in-reply-to:references; bh=d7QI9KCRJXSOvTIJePb6wpYh9+9Gmb6IS2PlNzePXfQ=; b=i9w6m2/MTv0VyocaqBIW+J3PBDEFvarhfZlvP7LYqFJVByTzEDxA+u+Es7B9WGz/2n XCoHs1ZmssaD5MsI3AUqggaq+aXshZYM48xcm8oqIBjRtKl3tNkMlrSzI49coVwNZorE ZLP09WYq2dqH/ehvt3W6YE5zvis7A76BtSy+eGqILZQkPW7HoM9G6fm54WdzMCDOr0+W zEhCmSW032ssEOJVuJtfiTkFeXsxxuD9xAqWI4lkzzE48CPALqkJlSmNiIP5tHmqisDF qeLIlmnmILkLZCRL2yTuEi//fo0fJejsF86WsAVn7+j7WdeJfW/gaxgDBzj3EIEcR/Ao cCkw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:in-reply-to:references; bh=d7QI9KCRJXSOvTIJePb6wpYh9+9Gmb6IS2PlNzePXfQ=; b=ePjG6efkmb9sGxzcYWkBzH8QxvEmf7vm8tmVsK2jVpbDyyjw3hc0lHa2Q7QJ+ZomGS uPEm92FRPW9CnD1nT/KF8Iy73krFFdnrNkf10KWE/PopC0Imbajldg/HZx4s/pQTyKzx GEDp1TpXu08jFTV7mJA4n+FRvJhe6+nOY9biYoNNOu5pIZFpZxhefafTvtMS2qoTz9V5 xTLoAgGjlk8R5N5pYfBWnkz16kKDIjiz57FOjv+c1UB4BsKwe4uhEh0ACVzYra8Urztd 6HEbnEHwsjW1rxn7NX3qK82PiDbT8O1yLEIxMPRK75Br7HpKuDDN8PYXALDwsQJuJHi1 eaOw== X-Gm-Message-State: AODbwcBtM4OpxadrFMg39bN1OLog9vcNsrR0gyyEcncZXcpgPYK5ByND oPpV7bY7NrLfvw== X-Received: by 10.25.195.21 with SMTP id t21mr6802687lff.103.1495498520912; Mon, 22 May 2017 17:15:20 -0700 (PDT) Received: from localhost.localdomain (ppp109-252-91-175.pppoe.spdop.ru. [109.252.91.175]) by smtp.gmail.com with ESMTPSA id v30sm3440904ljd.9.2017.05.22.17.15.20 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 22 May 2017 17:15:20 -0700 (PDT) From: Dmitry Osipenko To: Thierry Reding , Mikko Perttunen Subject: [PATCH 06/22] drm/tegra: Check syncpoint ID in the 'submit' IOCTL Date: Tue, 23 May 2017 03:14:21 +0300 Message-Id: X-Mailer: git-send-email 2.13.0 In-Reply-To: References: In-Reply-To: References: X-Mailman-Approved-At: Tue, 23 May 2017 00:59:38 +0000 Cc: linux-tegra@vger.kernel.org, DRI Development X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP In case of invalid syncpoint ID, the host1x_syncpt_get() returns NULL and none of its users perform a check of the returned pointer later. Let's bail out until it's too late. Signed-off-by: Dmitry Osipenko Reviewed-by: Mikko Perttunen --- drivers/gpu/drm/tegra/drm.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c index eae0c1512ab0..cdb05d6efde4 100644 --- a/drivers/gpu/drm/tegra/drm.c +++ b/drivers/gpu/drm/tegra/drm.c @@ -393,6 +393,8 @@ int tegra_drm_submit(struct tegra_drm_context *context, struct drm_tegra_waitchk __user *waitchks = (void __user *)(uintptr_t)args->waitchks; struct drm_tegra_syncpt syncpt; + struct host1x *host1x = dev_get_drvdata(drm->dev->parent); + struct host1x_syncpt *sp; struct host1x_job *job; int err; @@ -521,6 +523,13 @@ int tegra_drm_submit(struct tegra_drm_context *context, goto fail; } + /* check whether syncpoint ID is valid */ + sp = host1x_syncpt_get(host1x, syncpt.id); + if (!sp) { + err = -ENOENT; + goto fail; + } + job->is_addr_reg = context->client->ops->is_addr_reg; job->syncpt_incrs = syncpt.incrs; job->syncpt_id = syncpt.id;