mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-23 19:11:51 +00:00
Code Issues Releases Wiki Activity

drm/imagination: fix off by one in pvr_vm_mips_init() error handling

Browse source 
If the call to vmap() fails the "page_nr" is one element beyond the end
of the mips_data->pt_dma_addr[] and mips_data->pt_pages[] arrays.

The way that this is traditionally written is that we clean up the
partial loop iteration before the goto and then we can say
while (--i >= 0).  At that point we know that all the elements thus
far are initialized so we don't need to have NULL checks.

Fixes: 927f3e0253 ("drm/imagination: Implement MIPS firmware processor and MMU support")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Frank Binns <frank.binns@imgtec.com>
Signed-off-by: Maxime Ripard <mripard@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/a2d3210b-290f-4397-9c3e-efdcca94d8ac@moroto.mountain
This commit is contained in:
Dan Carpenter 2023-11-30 10:27:15 +03:00 committed by Maxime Ripard
parent 9ee33dc477
commit 55b0f4a7c3
No known key found for this signature in database
GPG key ID: E3EF0D6F671851C5
1 changed files with 5 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
drivers/gpu/drm/imagination/pvr_vm_mips.c
View file

@ -57,6 +57,7 @@ pvr_vm_mips_init(struct pvr_device *pvr_dev)
PAGE_SIZE, DMA_TO_DEVICE);
if (dma_mapping_error(dev, mips_data->pt_dma_addr[page_nr])) {
err = -ENOMEM;
__free_page(mips_data->pt_pages[page_nr]);
goto err_free_pages;
}
}
@ -79,13 +80,11 @@ pvr_vm_mips_init(struct pvr_device *pvr_dev)
return 0;
err_free_pages:
for (; page_nr >= 0; page_nr--) {
if (mips_data->pt_dma_addr[page_nr])
dma_unmap_page(from_pvr_device(pvr_dev)->dev,
mips_data->pt_dma_addr[page_nr], PAGE_SIZE, DMA_TO_DEVICE);
while (--page_nr >= 0) {
dma_unmap_page(from_pvr_device(pvr_dev)->dev,
mips_data->pt_dma_addr[page_nr], PAGE_SIZE, DMA_TO_DEVICE);
if (mips_data->pt_pages[page_nr])
__free_page(mips_data->pt_pages[page_nr]);
__free_page(mips_data->pt_pages[page_nr]);
}
return err;