Commit 17b11b76 authored by Boris Brezillon's avatar Boris Brezillon Committed by Eric Anholt

drm/vc4: Fix NULL pointer dereference in vc4_save_hang_state()

When saving BOs in the hang state we skip one entry of the
kernel_state->bo[] array, thus leaving it to NULL. This leads to a NULL
pointer dereference when, later in this function, we iterate over all
BOs to check their ->madv state.

Fixes: ca26d28b ("drm/vc4: improve throughput by pipelining binning and rendering jobs")
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarBoris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: default avatarEric Anholt <eric@anholt.net>
Reviewed-by: default avatarEric Anholt <eric@anholt.net>
Link: https://patchwork.freedesktop.org/patch/msgid/20180118145821.22344-1-boris.brezillon@free-electrons.com
parent f61145f1
...@@ -146,7 +146,7 @@ vc4_save_hang_state(struct drm_device *dev) ...@@ -146,7 +146,7 @@ vc4_save_hang_state(struct drm_device *dev)
struct vc4_exec_info *exec[2]; struct vc4_exec_info *exec[2];
struct vc4_bo *bo; struct vc4_bo *bo;
unsigned long irqflags; unsigned long irqflags;
unsigned int i, j, unref_list_count, prev_idx; unsigned int i, j, k, unref_list_count;
kernel_state = kcalloc(1, sizeof(*kernel_state), GFP_KERNEL); kernel_state = kcalloc(1, sizeof(*kernel_state), GFP_KERNEL);
if (!kernel_state) if (!kernel_state)
...@@ -182,7 +182,7 @@ vc4_save_hang_state(struct drm_device *dev) ...@@ -182,7 +182,7 @@ vc4_save_hang_state(struct drm_device *dev)
return; return;
} }
prev_idx = 0; k = 0;
for (i = 0; i < 2; i++) { for (i = 0; i < 2; i++) {
if (!exec[i]) if (!exec[i])
continue; continue;
...@@ -197,7 +197,7 @@ vc4_save_hang_state(struct drm_device *dev) ...@@ -197,7 +197,7 @@ vc4_save_hang_state(struct drm_device *dev)
WARN_ON(!refcount_read(&bo->usecnt)); WARN_ON(!refcount_read(&bo->usecnt));
refcount_inc(&bo->usecnt); refcount_inc(&bo->usecnt);
drm_gem_object_get(&exec[i]->bo[j]->base); drm_gem_object_get(&exec[i]->bo[j]->base);
kernel_state->bo[j + prev_idx] = &exec[i]->bo[j]->base; kernel_state->bo[k++] = &exec[i]->bo[j]->base;
} }
list_for_each_entry(bo, &exec[i]->unref_list, unref_head) { list_for_each_entry(bo, &exec[i]->unref_list, unref_head) {
...@@ -205,12 +205,12 @@ vc4_save_hang_state(struct drm_device *dev) ...@@ -205,12 +205,12 @@ vc4_save_hang_state(struct drm_device *dev)
* because they are naturally unpurgeable. * because they are naturally unpurgeable.
*/ */
drm_gem_object_get(&bo->base.base); drm_gem_object_get(&bo->base.base);
kernel_state->bo[j + prev_idx] = &bo->base.base; kernel_state->bo[k++] = &bo->base.base;
j++;
} }
prev_idx = j + 1;
} }
WARN_ON_ONCE(k != state->bo_count);
if (exec[0]) if (exec[0])
state->start_bin = exec[0]->ct0ca; state->start_bin = exec[0]->ct0ca;
if (exec[1]) if (exec[1])
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment