This fixes two problems found by inspection in the Tegra host1x driver: - NULL is not a valid pointer for gather_mem (we'll dereference it later without checking). - The length of the mod_locks array is NV_HOST1X_NB_MLOCKS, not NV_HOST1X_SYNCPT_NB_PTS. Signed-off-by: Robert Morell <rmorell@xxxxxxxxxx> --- drivers/video/tegra/host/dev.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/video/tegra/host/dev.c b/drivers/video/tegra/host/dev.c index daed882..46a1d61 100644 --- a/drivers/video/tegra/host/dev.c +++ b/drivers/video/tegra/host/dev.c @@ -106,7 +106,7 @@ static int nvhost_channelopen(struct inode *inode, struct file *filp) gather_size = sizeof(struct nvhost_op_pair) * NVHOST_MAX_GATHERS; priv->gather_mem = nvmap_alloc(ch->dev->nvmap, gather_size, 32, NVMAP_HANDLE_CACHEABLE); - if (IS_ERR(priv->gather_mem)) + if (IS_ERR_OR_NULL(priv->gather_mem)) goto fail; if (ch->ctxhandler.alloc) { @@ -452,7 +452,7 @@ static int nvhost_ioctl_ctrl_module_mutex( struct nvhost_ctrl_module_mutex_args *args) { int err = 0; - if (args->id >= NV_HOST1X_SYNCPT_NB_PTS || + if (args->id >= NV_HOST1X_NB_MLOCKS || args->lock > 1) return -EINVAL; -- 1.7.2.2 -- To unsubscribe from this list: send the line "unsubscribe linux-tegra" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html