Commit cc9a8e23 authored by Guangshuo Li's avatar Guangshuo Li Committed by Alex Deucher
Browse files

drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() 



kcalloc() may fail. When WS is non-zero and allocation fails, ectx.ws
remains NULL while ectx.ws_size is set, leading to a potential NULL
pointer dereference in atom_get_src_int() when accessing WS entries.

Return -ENOMEM on allocation failure to avoid the NULL dereference.

Signed-off-by: default avatarGuangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
parent 59e4405e

drivers/gpu/drm/amd/amdgpu/atom.c

+4 −0
Original line number Diff line number Diff line
@@ -1246,6 +1246,10 @@ static int amdgpu_atom_execute_table_locked(struct atom_context *ctx, int index, 
	ectx.last_jump_jiffies = 0;

	if (ws) {

		ectx.ws = kcalloc(4, ws, GFP_KERNEL);

		if (!ectx.ws) {

			ret = -ENOMEM;

			goto free;

		}

		ectx.ws_size = ws;

	} else {

		ectx.ws = NULL;