Unverified Commit 1342b313 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!8830 Fix CVE-2024-35951 

Merge Pull Request from: @ci-robot 
 
PR sync from: Cui GaoSheng <cuigaosheng1@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/Y5VVF4D63LW6RPWCNQ3THQXUPKXEY2NS/ 
Fix CVE-2024-35951.

Boris Brezillon (2):
  drm/panfrost: Fix the panfrost_mmu_map_fault_addr() error path
  drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/I9QRMU 
 
Link:https://gitee.com/openeuler/kernel/pulls/8830

 

Reviewed-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents b9076fcc 50e5a3f7

drivers/gpu/drm/panfrost/panfrost_mmu.c

+10 −4
Original line number Diff line number Diff line
@@ -447,11 +447,19 @@ static int panfrost_mmu_map_fault_addr(struct panfrost_device *pfdev, int as, 
	mapping_set_unevictable(mapping);



	for (i = page_offset; i < page_offset + NUM_FAULT_PAGES; i++) {

		/* Can happen if the last fault only partially filled this

		 * section of the pages array before failing. In that case

		 * we skip already filled pages.

		 */

		if (pages[i])

			continue;



		pages[i] = shmem_read_mapping_page(mapping, i);

		if (IS_ERR(pages[i])) {

			mutex_unlock(&bo->base.pages_lock);

			ret = PTR_ERR(pages[i]);

			goto err_pages;

			pages[i] = NULL;

			goto err_bo;

		}

	}
@@ -461,7 +469,7 @@ static int panfrost_mmu_map_fault_addr(struct panfrost_device *pfdev, int as, 
	ret = sg_alloc_table_from_pages(sgt, pages + page_offset,

					NUM_FAULT_PAGES, 0, SZ_2M, GFP_KERNEL);

	if (ret)

		goto err_pages;

		goto err_bo;



	ret = dma_map_sgtable(pfdev->dev, sgt, DMA_BIDIRECTIONAL, 0);

	if (ret)
@@ -481,8 +489,6 @@ static int panfrost_mmu_map_fault_addr(struct panfrost_device *pfdev, int as, 


err_map:

	sg_free_table(sgt);

err_pages:

	drm_gem_shmem_put_pages(&bo->base);

err_bo:

	panfrost_gem_mapping_put(bomapping);

	return ret;