* [PATCH] drm/imagination: Fix NULL pointer dereference
@ 2026-08-12 11:46 Alexandru Dadu
2026-08-19 8:52 ` Brajesh Gupta
0 siblings, 1 reply; 2+ messages in thread
From: Alexandru Dadu @ 2026-08-12 11:46 UTC (permalink / raw)
To: Alessio Belle, Luigi Santivetti, Maarten Lankhorst,
Maxime Ripard, Thomas Zimmermann, David Airlie, Simona Vetter
Cc: imagination, dri-devel, linux-kernel, Alexandru Dadu
Fix the NULL pointer dereference from pvr_fw_object_destroy() when
handling allocation failures.
Signed-off-by: Alexandru Dadu <alexandru.dadu@imgtec.com>
---
drivers/gpu/drm/imagination/pvr_fw.c | 28 ++++++++++++++++------------
1 file changed, 16 insertions(+), 12 deletions(-)
diff --git a/drivers/gpu/drm/imagination/pvr_fw.c b/drivers/gpu/drm/imagination/pvr_fw.c
index 850a3ec8e775..88f11fb01304 100644
--- a/drivers/gpu/drm/imagination/pvr_fw.c
+++ b/drivers/gpu/drm/imagination/pvr_fw.c
@@ -1425,22 +1425,26 @@ pvr_fw_object_create_and_map_offset(struct pvr_device *pvr_dev,
*/
void pvr_fw_object_destroy(struct pvr_fw_object *fw_obj)
{
- struct pvr_gem_object *pvr_obj = fw_obj->gem;
- struct drm_gem_object *gem_obj = gem_from_pvr_gem(pvr_obj);
- struct pvr_device *pvr_dev = to_pvr_device(gem_obj->dev);
+ if (!fw_obj)
+ return;
- mutex_lock(&pvr_dev->fw_dev.fw_objs.lock);
- list_del(&fw_obj->node);
- mutex_unlock(&pvr_dev->fw_dev.fw_objs.lock);
+ if (fw_obj->gem) {
+ struct pvr_gem_object *pvr_obj = fw_obj->gem;
+ struct drm_gem_object *gem_obj = gem_from_pvr_gem(pvr_obj);
+ struct pvr_device *pvr_dev = to_pvr_device(gem_obj->dev);
- if (drm_mm_node_allocated(&fw_obj->fw_mm_node)) {
- /* If we can't unmap, leak the memory. */
- if (WARN_ON(pvr_fw_object_fw_unmap(fw_obj)))
- return;
- }
+ mutex_lock(&pvr_dev->fw_dev.fw_objs.lock);
+ list_del(&fw_obj->node);
+ mutex_unlock(&pvr_dev->fw_dev.fw_objs.lock);
+
+ if (drm_mm_node_allocated(&fw_obj->fw_mm_node)) {
+ /* If we can't unmap, leak the memory. */
+ if (WARN_ON(pvr_fw_object_fw_unmap(fw_obj)))
+ return;
+ }
- if (fw_obj->gem)
pvr_gem_object_put(fw_obj->gem);
+ }
kfree(fw_obj);
}
---
base-commit: e55fead22ff9ee047ab9f1903860c4b43043514e
change-id: 20260812-fix-null-pointer-dereference-2c891142d988
Best regards,
--
Alexandru Dadu <alexandru.dadu@imgtec.com>
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: [PATCH] drm/imagination: Fix NULL pointer dereference
2026-08-12 11:46 [PATCH] drm/imagination: Fix NULL pointer dereference Alexandru Dadu
@ 2026-08-19 8:52 ` Brajesh Gupta
0 siblings, 0 replies; 2+ messages in thread
From: Brajesh Gupta @ 2026-08-19 8:52 UTC (permalink / raw)
To: Luigi Santivetti, tzimmermann, simona, airlied, Alessio Belle,
maarten.lankhorst, Alexandru Dadu, mripard
Cc: dri-devel, imagination, linux-kernel
On Wed, 2026-08-12 at 14:46 +0300, Alexandru Dadu wrote:
Hi Alexandru,
> Fix the NULL pointer dereference from pvr_fw_object_destroy() when
> handling allocation failures.
>
> Signed-off-by: Alexandru Dadu <alexandru.dadu@imgtec.com>
> ---
> drivers/gpu/drm/imagination/pvr_fw.c | 28 ++++++++++++++++------------
> 1 file changed, 16 insertions(+), 12 deletions(-)
>
> diff --git a/drivers/gpu/drm/imagination/pvr_fw.c b/drivers/gpu/drm/imagination/pvr_fw.c
> index 850a3ec8e775..88f11fb01304 100644
> --- a/drivers/gpu/drm/imagination/pvr_fw.c
> +++ b/drivers/gpu/drm/imagination/pvr_fw.c
> @@ -1425,22 +1425,26 @@ pvr_fw_object_create_and_map_offset(struct pvr_device *pvr_dev,
> */
> void pvr_fw_object_destroy(struct pvr_fw_object *fw_obj)
> {
> - struct pvr_gem_object *pvr_obj = fw_obj->gem;
> - struct drm_gem_object *gem_obj = gem_from_pvr_gem(pvr_obj);
> - struct pvr_device *pvr_dev = to_pvr_device(gem_obj->dev);
> + if (!fw_obj)
> + return;
>
> - mutex_lock(&pvr_dev->fw_dev.fw_objs.lock);
> - list_del(&fw_obj->node);
> - mutex_unlock(&pvr_dev->fw_dev.fw_objs.lock);
> + if (fw_obj->gem) {
> + struct pvr_gem_object *pvr_obj = fw_obj->gem;
> + struct drm_gem_object *gem_obj = gem_from_pvr_gem(pvr_obj);
> + struct pvr_device *pvr_dev = to_pvr_device(gem_obj->dev);
>
> - if (drm_mm_node_allocated(&fw_obj->fw_mm_node)) {
> - /* If we can't unmap, leak the memory. */
> - if (WARN_ON(pvr_fw_object_fw_unmap(fw_obj)))
> - return;
> - }
> + mutex_lock(&pvr_dev->fw_dev.fw_objs.lock);
> + list_del(&fw_obj->node);
> + mutex_unlock(&pvr_dev->fw_dev.fw_objs.lock);
> +
> + if (drm_mm_node_allocated(&fw_obj->fw_mm_node)) {
> + /* If we can't unmap, leak the memory. */
> + if (WARN_ON(pvr_fw_object_fw_unmap(fw_obj)))
> + return;
> + }
>
> - if (fw_obj->gem)
> pvr_gem_object_put(fw_obj->gem);
> + }
>
> kfree(fw_obj);
> }
>
> ---
> base-commit: e55fead22ff9ee047ab9f1903860c4b43043514e
> change-id: 20260812-fix-null-pointer-dereference-2c891142d988
>
> Best regards,
> --
> Alexandru Dadu <alexandru.dadu@imgtec.com>
>
Reviewed by: Brajesh Gupta <brajesh.gupta@imgtec.com>
Thanks,
Brajesh
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-08-19 9:22 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-08-12 11:46 [PATCH] drm/imagination: Fix NULL pointer dereference Alexandru Dadu
2026-08-19 8:52 ` Brajesh Gupta
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®