Commit 2d86348f authored by Boris Brezillon's avatar Boris Brezillon Committed by Cui GaoSheng
Browse files

drm/panfrost: Fix the panfrost_mmu_map_fault_addr() error path 

stable inclusion
from stable-v5.10.178
commit 8250f7f7ae21a67104e1c8c15ed250b2d01c122d
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRMU
CVE: CVE-2024-35951

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8250f7f7ae21a67104e1c8c15ed250b2d01c122d



--------------------------------

commit 764a2ab9 upstream.

Make sure all bo->base.pages entries are either NULL or pointing to a
valid page before calling drm_gem_shmem_put_pages().

Reported-by: default avatarTomeu Vizoso <tomeu.vizoso@collabora.com>
Cc: <stable@vger.kernel.org>
Fixes: 187d2929 ("drm/panfrost: Add support for GPU heap allocations")
Signed-off-by: default avatarBoris Brezillon <boris.brezillon@collabora.com>
Reviewed-by: default avatarSteven Price <steven.price@arm.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210521093811.1018992-1-boris.brezillon@collabora.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarCui GaoSheng <cuigaosheng1@huawei.com>
parent 3843717a

drivers/gpu/drm/panfrost/panfrost_mmu.c

+1 −0
Original line number Diff line number Diff line
@@ -451,6 +451,7 @@ static int panfrost_mmu_map_fault_addr(struct panfrost_device *pfdev, int as, 
		if (IS_ERR(pages[i])) {

			mutex_unlock(&bo->base.pages_lock);

			ret = PTR_ERR(pages[i]);

			pages[i] = NULL;

			goto err_pages;

		}

	}