aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c
diff options
context:
space:
mode:
authorZack Rusin <zackr@vmware.com>2021-12-15 15:02:24 -0500
committerZack Rusin <zackr@vmware.com>2021-12-16 10:33:13 -0500
commit60c9ecd705be3a28f79d70ea21c3939db668bf46 (patch)
treed3a241f4969e6c30bcd3fce2a98cc34258a52a0e /drivers/gpu/drm/vmwgfx/vmwgfx_bo.c
parentdrm/vmwgfx: Remove unused compile options (diff)
downloadlinux-dev-60c9ecd705be3a28f79d70ea21c3939db668bf46.tar.xz
linux-dev-60c9ecd705be3a28f79d70ea21c3939db668bf46.zip
drm/vmwgfx: Fix possible usage of an uninitialized variable
vmw_user_bo_lookup can fail to lookup user buffers, especially because the buffer handles come from the userspace. The return value has to be checked before the buffers are put back. This was spotted by Dan's Smatch statick checker: drivers/gpu/drm/vmwgfx/vmwgfx_bo.c:574 vmw_user_bo_synccpu_release() error: uninitialized symbol 'vmw_bo'. Signed-off-by: Zack Rusin <zackr@vmware.com> Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Fixes: 8afa13a0583f ("drm/vmwgfx: Implement DRIVER_GEM") Reviewed-by: Martin Krastev <krastevm@vmware.com> Link: https://patchwork.freedesktop.org/patch/msgid/20211215200224.3693345-1-zack@kde.org
Diffstat (limited to 'drivers/gpu/drm/vmwgfx/vmwgfx_bo.c')
-rw-r--r--drivers/gpu/drm/vmwgfx/vmwgfx_bo.c8
1 files changed, 5 insertions, 3 deletions
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c
index 15fead85450c..31aecc46624b 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c
@@ -568,10 +568,12 @@ static int vmw_user_bo_synccpu_release(struct drm_file *filp,
struct vmw_buffer_object *vmw_bo;
int ret = vmw_user_bo_lookup(filp, handle, &vmw_bo);
- if (!(flags & drm_vmw_synccpu_allow_cs)) {
- atomic_dec(&vmw_bo->cpu_writers);
+ if (!ret) {
+ if (!(flags & drm_vmw_synccpu_allow_cs)) {
+ atomic_dec(&vmw_bo->cpu_writers);
+ }
+ ttm_bo_put(&vmw_bo->base);
}
- ttm_bo_put(&vmw_bo->base);
return ret;
}