Commit d65146c7 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman

drm/savage: dereferencing an error pointer

commit f7741aa7 upstream.

A recent cleanup changed the kmalloc() + copy_from_user() to
memdup_user() but the error handling wasn't updated so we might call
kfree(-EFAULT) and crash.

Fixes: a6e3918b ('GPU-DRM-Savage: Use memdup_user() rather than duplicating')
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/20161012062227.GU12841@mwandaSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent c730a84a
...@@ -1004,6 +1004,7 @@ int savage_bci_cmdbuf(struct drm_device *dev, void *data, struct drm_file *file_ ...@@ -1004,6 +1004,7 @@ int savage_bci_cmdbuf(struct drm_device *dev, void *data, struct drm_file *file_
kvb_addr = memdup_user(cmdbuf->vb_addr, cmdbuf->vb_size); kvb_addr = memdup_user(cmdbuf->vb_addr, cmdbuf->vb_size);
if (IS_ERR(kvb_addr)) { if (IS_ERR(kvb_addr)) {
ret = PTR_ERR(kvb_addr); ret = PTR_ERR(kvb_addr);
kvb_addr = NULL;
goto done; goto done;
} }
cmdbuf->vb_addr = kvb_addr; cmdbuf->vb_addr = kvb_addr;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment