From: Li RongQing lirongqing@baidu.com
Move dma_resv_assert_held() after the validation of 'attach' and 'attach->dmabuf' to avoid a potential null pointer dereference if the function is ever called with invalid arguments.
Signed-off-by: Li RongQing lirongqing@baidu.com --- drivers/dma-buf/dma-buf-mapping.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/dma-buf/dma-buf-mapping.c b/drivers/dma-buf/dma-buf-mapping.c index 794acff..e6ecd6c 100644 --- a/drivers/dma-buf/dma-buf-mapping.c +++ b/drivers/dma-buf/dma-buf-mapping.c @@ -102,12 +102,12 @@ struct sg_table *dma_buf_phys_vec_to_sgt(struct dma_buf_attachment *attach, size_t i; int ret;
- dma_resv_assert_held(attach->dmabuf->resv); - if (WARN_ON(!attach || !attach->dmabuf || !provider)) /* This function is supposed to work on MMIO memory only */ return ERR_PTR(-EINVAL);
+ dma_resv_assert_held(attach->dmabuf->resv); + dma = kzalloc_obj(*dma); if (!dma) return ERR_PTR(-ENOMEM);