From: Yang Yingliang
ohos inclusion
category: bugfix
issue: #I3ZXZF
CVE: CVE-2019-16230
-------------------------------------------------
check the alloc_workqueue return value in radeon_crtc_init()
to avoid null-ptr-deref.
Signed-off-by: Yang Yingliang
Reviewed-by: Hanjun Guo
Signed-off-by: Yang Yingliang
Signed-off-by: Chen Jun
Reviewed-by: Xie XiuQi
Signed-off-by: Chen Jun
Signed-off-by: Yu Changchun
---
drivers/gpu/drm/radeon/radeon_display.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index e0ae911ef427..b709836fe3d3 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -689,11 +689,16 @@ static void radeon_crtc_init(struct drm_device *dev, int index)
if (radeon_crtc == NULL)
return;
+ radeon_crtc->flip_queue = alloc_workqueue("radeon-crtc", WQ_HIGHPRI, 0);
+ if (!radeon_crtc->flip_queue) {
+ kfree(radeon_crtc);
+ return;
+ }
+
drm_crtc_init(dev, &radeon_crtc->base, &radeon_crtc_funcs);
drm_mode_crtc_set_gamma_size(&radeon_crtc->base, 256);
radeon_crtc->crtc_id = index;
- radeon_crtc->flip_queue = alloc_workqueue("radeon-crtc", WQ_HIGHPRI, 0);
rdev->mode_info.crtcs[index] = radeon_crtc;
if (rdev->family >= CHIP_BONAIRE) {
--
2.22.0
