diff options
| author | Tim Gardner <tim.gardner@canonical.com> | 2013-02-11 14:34:32 -0700 |
|---|---|---|
| committer | Alex Deucher <alexander.deucher@amd.com> | 2013-02-20 08:51:19 -0500 |
| commit | 0e34d0945ed16aeb72c863be4efe4cd0c62f9c53 (patch) | |
| tree | acc055d3c3fd2c4ec2972b7d5d16a729097e670f /drivers/gpu/drm/radeon/atom.c | |
| parent | c944b2abb067130542055666f23409fd5e1afc8e (diff) | |
| download | linux-stable-0e34d0945ed16aeb72c863be4efe4cd0c62f9c53.tar.gz linux-stable-0e34d0945ed16aeb72c863be4efe4cd0c62f9c53.tar.bz2 linux-stable-0e34d0945ed16aeb72c863be4efe4cd0c62f9c53.zip | |
drm/radeon: Avoid NULL pointer dereference from atom_index_iio() allocation failure
Smatch anlysis:
drivers/gpu/drm/radeon/atom.c:1242 atom_index_iio() error: potential null
dereference 'ctx->iio'. (kzalloc returns null)
Also cleaned up some checks before calls to kfree(). kfree(NULL) is OK.
Cc: David Airlie <airlied@linux.ie>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: "Michel Dänzer" <michel.daenzer@amd.com>
Cc: Dave Airlie <airlied@redhat.com>
Cc: "Christian König" <christian.koenig@amd.com>
Cc: Jerome Glisse <jglisse@redhat.com>
Cc: dri-devel@lists.freedesktop.org
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Diffstat (limited to 'drivers/gpu/drm/radeon/atom.c')
| -rw-r--r-- | drivers/gpu/drm/radeon/atom.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c index 5ce9bf51a8de..46a9c3772850 100644 --- a/drivers/gpu/drm/radeon/atom.c +++ b/drivers/gpu/drm/radeon/atom.c @@ -1238,6 +1238,8 @@ static int atom_iio_len[] = { 1, 2, 3, 3, 3, 3, 4, 4, 4, 3 }; static void atom_index_iio(struct atom_context *ctx, int base) { ctx->iio = kzalloc(2 * 256, GFP_KERNEL); + if (!ctx->iio) + return; while (CU8(base) == ATOM_IIO_START) { ctx->iio[CU8(base + 1)] = base + 2; base += 2; @@ -1287,6 +1289,10 @@ struct atom_context *atom_parse(struct card_info *card, void *bios) ctx->cmd_table = CU16(base + ATOM_ROM_CMD_PTR); ctx->data_table = CU16(base + ATOM_ROM_DATA_PTR); atom_index_iio(ctx, CU16(ctx->data_table + ATOM_DATA_IIO_PTR) + 4); + if (!ctx->iio) { + atom_destroy(ctx); + return NULL; + } str = CSTR(CU16(base + ATOM_ROM_MSG_PTR)); while (*str && ((*str == '\n') || (*str == '\r'))) @@ -1335,8 +1341,7 @@ int atom_asic_init(struct atom_context *ctx) void atom_destroy(struct atom_context *ctx) { - if (ctx->iio) - kfree(ctx->iio); + kfree(ctx->iio); kfree(ctx); } |