Skip to content

Commit

Permalink
video: rockchip: vcodec_iommu_ion fix null pointer crash
Browse files Browse the repository at this point in the history
Can not pass NULL address for vcodec_iommu_map_iommu, which will do
access to the iova and size.

Test on RK3399 EVB:
[    0.918046] Unable to handle kernel NULL pointer dereference at virtual address 00000000
[    0.919653] pgd = ffffff80095b2000
[    0.919958] [00000000] *pgd=00000000f7ffe003, *pud=00000000f7ffe003, *pmd=0000000000000000
[    0.920722] Internal error: Oops: 96000045 [#1] PREEMPT SMP
[    0.921220] Modules linked in:
[    0.921509] CPU: 4 PID: 1 Comm: swapper/0 Not tainted 4.4.194 #8
[    0.922041] Hardware name: rockchip,rk3399-excavator-edp (DT)
[    0.922551] task: ffffffc00a368000 task.stack: ffffffc00a344000
[    0.923080] PC is at ion_map_iommu+0x160/0x2c4
[    0.923478] LR is at ion_map_iommu+0x148/0x2c4

Change-Id: I74837f7f7af2b62915af70ecf0be2f621484284f
Signed-off-by: Jianqun Xu <[email protected]>
  • Loading branch information
jayxurockchip committed Jul 16, 2020
1 parent ba30a52 commit 3610b20
Showing 1 changed file with 4 additions and 2 deletions.
6 changes: 4 additions & 2 deletions drivers/video/rockchip/vcodec/vcodec_service.c
Original file line number Diff line number Diff line change
Expand Up @@ -3021,6 +3021,8 @@ static int vcodec_subdev_probe(struct platform_device *pdev,
list_session);
const char *name = np->name;
char mmu_dev_dts_name[40];
dma_addr_t iova = -1;
unsigned long size = 0;

dev_info(dev, "probe device");

Expand Down Expand Up @@ -3132,8 +3134,8 @@ static int vcodec_subdev_probe(struct platform_device *pdev,
}

vcodec_iommu_map_iommu(data->iommu_info, session,
data->pa_hdl, NULL, NULL);
data->pa_iova = (unsigned long)-1;
data->pa_hdl, &iova, &size);
data->pa_iova = iova;
vcodec_exit_mode(data);

hw_info = data->hw_info;
Expand Down

0 comments on commit 3610b20

Please sign in to comment.