On Wed, 2026-08-12 at 14:46 +0300, Alexandru Dadu wrote: Hi Alexandru, > Fix the NULL pointer dereference from pvr_fw_object_destroy() when > handling allocation failures. > > Signed-off-by: Alexandru Dadu <[email protected]> > --- > drivers/gpu/drm/imagination/pvr_fw.c | 28 ++++++++++++++++------------ > 1 file changed, 16 insertions(+), 12 deletions(-) > > diff --git a/drivers/gpu/drm/imagination/pvr_fw.c > b/drivers/gpu/drm/imagination/pvr_fw.c > index 850a3ec8e775..88f11fb01304 100644 > --- a/drivers/gpu/drm/imagination/pvr_fw.c > +++ b/drivers/gpu/drm/imagination/pvr_fw.c > @@ -1425,22 +1425,26 @@ pvr_fw_object_create_and_map_offset(struct pvr_device > *pvr_dev, > */ > void pvr_fw_object_destroy(struct pvr_fw_object *fw_obj) > { > - struct pvr_gem_object *pvr_obj = fw_obj->gem; > - struct drm_gem_object *gem_obj = gem_from_pvr_gem(pvr_obj); > - struct pvr_device *pvr_dev = to_pvr_device(gem_obj->dev); > + if (!fw_obj) > + return; > > - mutex_lock(&pvr_dev->fw_dev.fw_objs.lock); > - list_del(&fw_obj->node); > - mutex_unlock(&pvr_dev->fw_dev.fw_objs.lock); > + if (fw_obj->gem) { > + struct pvr_gem_object *pvr_obj = fw_obj->gem; > + struct drm_gem_object *gem_obj = gem_from_pvr_gem(pvr_obj); > + struct pvr_device *pvr_dev = to_pvr_device(gem_obj->dev); > > - if (drm_mm_node_allocated(&fw_obj->fw_mm_node)) { > - /* If we can't unmap, leak the memory. */ > - if (WARN_ON(pvr_fw_object_fw_unmap(fw_obj))) > - return; > - } > + mutex_lock(&pvr_dev->fw_dev.fw_objs.lock); > + list_del(&fw_obj->node); > + mutex_unlock(&pvr_dev->fw_dev.fw_objs.lock); > + > + if (drm_mm_node_allocated(&fw_obj->fw_mm_node)) { > + /* If we can't unmap, leak the memory. */ > + if (WARN_ON(pvr_fw_object_fw_unmap(fw_obj))) > + return; > + } > > - if (fw_obj->gem) > pvr_gem_object_put(fw_obj->gem); > + } > > kfree(fw_obj); > } > > --- > base-commit: e55fead22ff9ee047ab9f1903860c4b43043514e > change-id: 20260812-fix-null-pointer-dereference-2c891142d988 > > Best regards, > -- > Alexandru Dadu <[email protected]> > Reviewed by: Brajesh Gupta <[email protected]>
Thanks, Brajesh
