drm/virtio: Ensure that objs is not NULL in virtio_gpu_array_put_free()

robertosassu · gregkh · commit b094fece3810 · 2022-03-28T09:58:45.000+02:00
commit 6b79f96 upstream. If virtio_gpu_object_shmem_init() fails (e.g. due to fault injection, as it happened in the bug report by syzbot), virtio_gpu_array_put_free() could be called with objs equal to NULL. Ensure that objs is not NULL in virtio_gpu_array_put_free(), or otherwise return from the function. Cc: stable@vger.kernel.org # 5.13.x Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Reported-by: syzbot+e9072e90624a31dfa85f@syzkaller.appspotmail.com Fixes: 377f833 ("drm/virtio: fix possible leak/unlock virtio_gpu_object_array") Link: http://patchwork.freedesktop.org/patch/msgid/20211213183122.838119-1-roberto.sassu@huawei.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
diff --git a/drivers/gpu/drm/virtio/virtgpu_gem.c b/drivers/gpu/drm/virtio/virtgpu_gem.c
@@ -248,6 +248,9 @@ void virtio_gpu_array_put_free(struct virtio_gpu_object_array *objs)
 {
 	u32 i;
 
+	if (!objs)
+		return;
+
 	for (i = 0; i < objs->nents; i++)
 		drm_gem_object_put(objs->objs[i]);
 	virtio_gpu_array_free(objs);

Original file line number	Diff line number	Diff line change
`@@ -248,6 +248,9 @@ void virtio_gpu_array_put_free(struct virtio_gpu_object_array *objs)`
`248`	`248`	`{`
`249`	`249`	`u32 i;`
`250`	`250`
	`251`	`+ if (!objs)`
	`252`	`+ return;`
	`253`	`+`
`251`	`254`	`for (i = 0; i < objs->nents; i++)`
`252`	`255`	`drm_gem_object_put(objs->objs[i]);`
`253`	`256`	`virtio_gpu_array_free(objs);`