Commit a4a7d887 authored by Pierre-Eric Pelloux-Prayer's avatar Pierre-Eric Pelloux-Prayer Committed by Wupeng Ma
Browse files

drm/radeon: check bo_va->bo is non-NULL before using it 

stable inclusion
from stable-v6.6.42
commit f13c96e0e325a057c03f8a47734adb360e112efe
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEMD
CVE: CVE-2024-41060

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f13c96e0e325a057c03f8a47734adb360e112efe



--------------------------------

[ Upstream commit 6fb15dcbcf4f212930350eaee174bb60ed40a536 ]

The call to radeon_vm_clear_freed might clear bo_va->bo, so
we have to check it before dereferencing it.

Signed-off-by: default avatarPierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com>
Acked-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>

Conflicts:
	drivers/gpu/drm/radeon/radeon_gem.c
[Ma Wupeng: Context conflict]
Signed-off-by: default avatarMa Wupeng <mawupeng1@huawei.com>
parent 02994a9b

drivers/gpu/drm/radeon/radeon_gem.c

+1 −1
Original line number Diff line number Diff line
@@ -582,7 +582,7 @@ static void radeon_gem_va_update_vm(struct radeon_device *rdev, 
	if (r)

		goto error_unlock;



	if (bo_va->it.start)

	if (bo_va->it.start && bo_va->bo)

		r = radeon_vm_bo_update(rdev, bo_va, &bo_va->bo->tbo.mem);



error_unlock: