Hi Jonathan,
On Thu, Oct 13, 2022 at 10:56:50AM -0700, Jonathan Cavitt wrote:
> i915_ttm_to_gem can return a NULL pointer, which is
> dereferenced in i915_ttm_access_memory without first
> checking if it is NULL. Inspecting
> i915_ttm_io_mem_reserve, it appears the correct
> behavior in this case is to return -EINVAL.
>
> Fixes: 26b15eb0 ("drm/i915/ttm: implement access_memory")
> Signed-off-by: Jonathan Cavitt <jonathan.cavitt@xxxxxxxxx>
> Suggested-by: John C Harrison <John.C.Harrison@xxxxxxxxx>
> CC: Matthew Auld <matthew.auld@xxxxxxxxx>
> CC: Andrzej Hajda <andrzej.hajda@xxxxxxxxx>
> CC: Nirmoy Das <nirmoy.das@xxxxxxxxx>
> CC: Andi Shyti <andi.shyti@xxxxxxxxxxxxxxx>
Reviewed-by: Andi Shyti <andi.shyti@xxxxxxxxxxxxxxx>
Thanks,
Andi
> ---
> drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 9 +++++++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
> index d63f30efd631..b569624f2ed9 100644
> --- a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
> +++ b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
> @@ -704,11 +704,16 @@ static int i915_ttm_access_memory(struct ttm_buffer_object *bo,
> int len, int write)
> {
> struct drm_i915_gem_object *obj = i915_ttm_to_gem(bo);
> - resource_size_t iomap = obj->mm.region->iomap.base -
> - obj->mm.region->region.start;
> + resource_size_t iomap;
> unsigned long page = offset >> PAGE_SHIFT;
> unsigned long bytes_left = len;
>
> + if (!obj)
> + return -EINVAL;
> +
> + iomap = obj->mm.region->iomap.base -
> + obj->mm.region->region.start;
> +
> /*
> * TODO: For now just let it fail if the resource is non-mappable,
> * otherwise we need to perform the memcpy from the gpu here, without
> --
> 2.25.1
