From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S942362AbdEYPas (ORCPT ); Thu, 25 May 2017 11:30:48 -0400 Received: from mail-yw0-f174.google.com ([209.85.161.174]:35905 "EHLO mail-yw0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934547AbdEYPar (ORCPT ); Thu, 25 May 2017 11:30:47 -0400 Date: Thu, 25 May 2017 11:30:45 -0400 From: Sean Paul To: Jeffy Chen Cc: linux-kernel@vger.kernel.org, seanpaul@chromium.org, tfiga@chromium.org, Mark Yao , Heiko Stuebner , dri-devel@lists.freedesktop.org, linux-rockchip@lists.infradead.org, David Airlie , linux-arm-kernel@lists.infradead.org Subject: Re: [PATCH] drm/rockchip: Don't allow zero sized gem buffer Message-ID: <20170525153045.7svkkmfsqbqkfacp@art_vandelay> References: <1495521583-29151-1-git-send-email-jeffy.chen@rock-chips.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1495521583-29151-1-git-send-email-jeffy.chen@rock-chips.com> User-Agent: NeoMutt/20170306-66-6ddb52-dirty (1.8.0) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, May 23, 2017 at 02:39:43PM +0800, Jeffy Chen wrote: > The system would crash when trying to alloc zero sized gem buffer: > [ 6.712435] Unable to handle kernel NULL pointer dereference at virtual address 00000010 <--ZERO_SIZE_PTR > ... > [ 6.757502] PC is at sg_alloc_table_from_pages+0x170/0x1ec It's unfortunate that you didn't include the entire stack trace. From code inspection, it seems like the 0 size comes from the fb_probe path? Is there somewhere in the helpers that you could check the mode is sane so all drivers can benefit? Sean > > Signed-off-by: Jeffy Chen > --- > > drivers/gpu/drm/rockchip/rockchip_drm_gem.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c > index df9e570..8917922 100644 > --- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c > +++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c > @@ -315,6 +315,11 @@ struct rockchip_gem_object * > struct drm_gem_object *obj; > int ret; > > + if (!size) { > + DRM_ERROR("gem buffer size is zero\n"); > + return ERR_PTR(-EINVAL); > + } > + > size = round_up(size, PAGE_SIZE); > > rk_obj = kzalloc(sizeof(*rk_obj), GFP_KERNEL); > -- > 2.1.4 > -- Sean Paul, Software Engineer, Google / Chromium OS