9af2b41a3f
commit 26498b8d54373d31a621d7dec95c4bd842563b3b upstream. Currently if condition (!bo and !vmw_kms_srf_ok()) was met we go to err_out with ret == 0. err_out dereferences vfb if ret == 0, but in our case vfb is still NULL. Fix this by assigning sensible error to ret. Found by Linux Verification Center (linuxtesting.org) with SVACE Signed-off-by: Nikolay Kuratov <kniv@yandex-team.ru> Cc: stable@vger.kernel.org Fixes: 810b3e1683d0 ("drm/vmwgfx: Support topology greater than texture size") Signed-off-by: Zack Rusin <zack.rusin@broadcom.com> Link: https://patchwork.freedesktop.org/patch/msgid/20241002122429.1981822-1-kniv@yandex-team.ru Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|---|---|---|
| .. | ||
| device_include | ||
| Kconfig | ||
| Makefile | ||
| ttm_lock.c | ||
| ttm_lock.h | ||
| ttm_object.c | ||
| ttm_object.h | ||
| vmwgfx_binding.c | ||
| vmwgfx_binding.h | ||
| vmwgfx_blit.c | ||
| vmwgfx_bo.c | ||
| vmwgfx_cmdbuf.c | ||
| vmwgfx_cmdbuf_res.c | ||
| vmwgfx_context.c | ||
| vmwgfx_cotable.c | ||
| vmwgfx_drv.c | ||
| vmwgfx_drv.h | ||
| vmwgfx_execbuf.c | ||
| vmwgfx_fb.c | ||
| vmwgfx_fence.c | ||
| vmwgfx_fence.h | ||
| vmwgfx_fifo.c | ||
| vmwgfx_gmr.c | ||
| vmwgfx_gmrid_manager.c | ||
| vmwgfx_ioctl.c | ||
| vmwgfx_irq.c | ||
| vmwgfx_kms.c | ||
| vmwgfx_kms.h | ||
| vmwgfx_ldu.c | ||
| vmwgfx_marker.c | ||
| vmwgfx_mob.c | ||
| vmwgfx_msg.c | ||
| vmwgfx_msg.h | ||
| vmwgfx_overlay.c | ||
| vmwgfx_page_dirty.c | ||
| vmwgfx_prime.c | ||
| vmwgfx_reg.h | ||
| vmwgfx_resource.c | ||
| vmwgfx_resource_priv.h | ||
| vmwgfx_scrn.c | ||
| vmwgfx_shader.c | ||
| vmwgfx_simple_resource.c | ||
| vmwgfx_so.c | ||
| vmwgfx_so.h | ||
| vmwgfx_stdu.c | ||
| vmwgfx_streamoutput.c | ||
| vmwgfx_surface.c | ||
| vmwgfx_thp.c | ||
| vmwgfx_ttm_buffer.c | ||
| vmwgfx_ttm_glue.c | ||
| vmwgfx_va.c | ||
| vmwgfx_validation.c | ||
| vmwgfx_validation.h | ||