Commit 93d1f41a authored by Chen Ridong's avatar Chen Ridong Committed by Zack Rusin
Browse files

drm/vmwgfx: avoid null_ptr_deref in vmw_framebuffer_surface_create_handle 



The 'vmw_user_object_buffer' function may return NULL with incorrect
inputs. To avoid possible null pointer dereference, add a check whether
the 'bo' is NULL in the vmw_framebuffer_surface_create_handle.

Fixes: d6667f0d ("drm/vmwgfx: Fix handling of dumb buffers")
Signed-off-by: default avatarChen Ridong <chenridong@huawei.com>
Signed-off-by: default avatarZack Rusin <zack.rusin@broadcom.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20241029083429.1185479-1-chenridong@huaweicloud.com
parent 9776c0a7

drivers/gpu/drm/vmwgfx/vmwgfx_kms.c

+2 −0
Original line number Diff line number Diff line
@@ -1265,6 +1265,8 @@ static int vmw_framebuffer_surface_create_handle(struct drm_framebuffer *fb, 
	struct vmw_framebuffer_surface *vfbs = vmw_framebuffer_to_vfbs(fb);

	struct vmw_bo *bo = vmw_user_object_buffer(&vfbs->uo);



	if (WARN_ON(!bo))

		return -EINVAL;

	return drm_gem_handle_create(file_priv, &bo->tbo.base, handle);

}