From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1761650AbdEWGkI (ORCPT ); Tue, 23 May 2017 02:40:08 -0400 Received: from regular1.263xmail.com ([211.150.99.135]:38109 "EHLO regular1.263xmail.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751218AbdEWGkG (ORCPT ); Tue, 23 May 2017 02:40:06 -0400 X-263anti-spam: KSV:0; X-MAIL-GRAY: 0 X-MAIL-DELIVERY: 1 X-KSVirus-check: 0 X-ABS-CHECKED: 4 X-RL-SENDER: jeffy.chen@rock-chips.com X-FST-TO: linux-kernel@vger.kernel.org X-SENDER-IP: 103.29.142.67 X-LOGIN-NAME: jeffy.chen@rock-chips.com X-UNIQUE-TAG: <0bae9100edcc0038593b05c82201e63c> X-ATTACHMENT-NUM: 0 X-DNS-TYPE: 0 From: Jeffy Chen To: linux-kernel@vger.kernel.org Cc: seanpaul@chromium.org, tfiga@chromium.org, Jeffy Chen , Mark Yao , Heiko Stuebner , dri-devel@lists.freedesktop.org, linux-rockchip@lists.infradead.org, David Airlie , linux-arm-kernel@lists.infradead.org Subject: [PATCH] drm/rockchip: Don't allow zero sized gem buffer Date: Tue, 23 May 2017 14:39:43 +0800 Message-Id: <1495521583-29151-1-git-send-email-jeffy.chen@rock-chips.com> X-Mailer: git-send-email 2.1.4 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The system would crash when trying to alloc zero sized gem buffer: [ 6.712435] Unable to handle kernel NULL pointer dereference at virtual address 00000010 <--ZERO_SIZE_PTR ... [ 6.757502] PC is at sg_alloc_table_from_pages+0x170/0x1ec Signed-off-by: Jeffy Chen --- drivers/gpu/drm/rockchip/rockchip_drm_gem.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c index df9e570..8917922 100644 --- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c +++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c @@ -315,6 +315,11 @@ struct rockchip_gem_object * struct drm_gem_object *obj; int ret; + if (!size) { + DRM_ERROR("gem buffer size is zero\n"); + return ERR_PTR(-EINVAL); + } + size = round_up(size, PAGE_SIZE); rk_obj = kzalloc(sizeof(*rk_obj), GFP_KERNEL); -- 2.1.4