From: Dan Carpenter Date: Mon, 17 Feb 2025 07:31:21 +0000 (+0300) Subject: drm/nouveau: Fix error pointer dereference in r535_gsp_msgq_recv() X-Git-Tag: v6.15-rc1~120^2~19^2~30 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fdee05235a25bac8495e1261be10a7727ffd0a79;p=thirdparty%2Fkernel%2Flinux.git drm/nouveau: Fix error pointer dereference in r535_gsp_msgq_recv() If "rpc" is an error pointer then return directly. Otherwise it leads to an error pointer dereference. Fixes: 50f290053d79 ("drm/nouveau: support handling the return of large GSP message") Signed-off-by: Dan Carpenter Acked-by: Zhi Wang Signed-off-by: Danilo Krummrich Link: https://patchwork.freedesktop.org/patch/msgid/b7052ac0-98e4-433b-ad58-f563bf51858c@stanley.mountain --- diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c index 2075cad638053..db2602e880062 100644 --- a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c @@ -348,6 +348,7 @@ r535_gsp_msgq_recv(struct nvkm_gsp *gsp, u32 gsp_rpc_len, int *retries) if (IS_ERR(buf)) { kvfree(info.gsp_rpc_buf); info.gsp_rpc_buf = NULL; + return buf; } if (expected <= max_rpc_size)