drm/etnaviv: potential NULL dereference

Dan Carpenter · lynxeye-dev · commit 9e05352340d3 · 2019-02-11T11:50:43.000+01:00
The etnaviv_gem_prime_get_sg_table() is supposed to return error pointers. Otherwise it can lead to a NULL dereference when it's called from drm_gem_map_dma_buf(). Fixes: 5f4a4a7 ("drm/etnaviv: fix gem_prime_get_sg_table to return new SG table") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Christian Gmeiner <christian.gmeiner@gmail.com> Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
@@ -15,7 +15,7 @@ struct sg_table *etnaviv_gem_prime_get_sg_table(struct drm_gem_object *obj)
 	int npages = obj->size >> PAGE_SHIFT;
 
 	if (WARN_ON(!etnaviv_obj->pages))  /* should have already pinned! */
-		return NULL;
+		return ERR_PTR(-EINVAL);
 
 	return drm_prime_pages_to_sg(etnaviv_obj->pages, npages);
 }

Original file line number	Diff line number	Diff line change
`@@ -15,7 +15,7 @@ struct sg_table etnaviv_gem_prime_get_sg_table(struct drm_gem_object obj)`
`15`	`15`	`int npages = obj->size >> PAGE_SHIFT;`
`16`	`16`
`17`	`17`	`if (WARN_ON(!etnaviv_obj->pages)) /* should have already pinned! */`
`18`		`- return NULL;`
	`18`	`+ return ERR_PTR(-EINVAL);`
`19`	`19`
`20`	`20`	`return drm_prime_pages_to_sg(etnaviv_obj->pages, npages);`
`21`	`21`	`}`