drm/msm: fix missing NULL check after kcalloc in crashstate_get_bos()

The crashstate_get_bos() function allocates memory for `state->bos`
using kcalloc(), but the vmbind path does not check for allocation
failure before dereferencing it in the following drm_gpuvm_for_each_va()
loop. This could lead to a NULL pointer dereference if memory allocation
fails.

Fix this by wrapping the drm_gpuvm_for_each_va() loop with a NULL check
on state->bos, similar to the safety check in the non-vmbind path.

Fixes: af9aa6f316b3d ("drm/msm: Crashdump support for sparse")
Signed-off-by: Huiwen He <hehuiwen@kylinos.cn>
Patchwork: https://patchwork.freedesktop.org/patch/687556/
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>

diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
index e23f70fbc8cb248150012e9645a65095fdaaa98a..dd0605fe1243da29805c0b41ab3962ec9100ef40 100644 (file)
--- a/drivers/gpu/drm/msm/msm_gpu.c
+++ b/drivers/gpu/drm/msm/msm_gpu.c
@@ -287,16 +287,17 @@ static void crashstate_get_bos(struct msm_gpu_state *state, struct msm_gem_submi
 
                state->bos = kcalloc(cnt, sizeof(struct msm_gpu_state_bo), GFP_KERNEL);
 
-               drm_gpuvm_for_each_va (vma, submit->vm) {
-                       bool dump = rd_full || (vma->flags & MSM_VMA_DUMP);
+               if (state->bos)
+                       drm_gpuvm_for_each_va(vma, submit->vm) {
+                               bool dump = rd_full || (vma->flags & MSM_VMA_DUMP);
 
-                       /* Skip MAP_NULL/PRR VMAs: */
-                       if (!vma->gem.obj)
-                               continue;
+                               /* Skip MAP_NULL/PRR VMAs: */
+                               if (!vma->gem.obj)
+                                       continue;
 
-                       msm_gpu_crashstate_get_bo(state, vma->gem.obj, vma->va.addr,
-                                                 dump, vma->gem.offset, vma->va.range);
-               }
+                               msm_gpu_crashstate_get_bo(state, vma->gem.obj, vma->va.addr,
+                                                         dump, vma->gem.offset, vma->va.range);
+                       }
 
                drm_exec_fini(&exec);
        } else {