Skip to content

Commit 3610b20

Browse files
committed
video: rockchip: vcodec_iommu_ion fix null pointer crash
Can not pass NULL address for vcodec_iommu_map_iommu, which will do access to the iova and size. Test on RK3399 EVB: [ 0.918046] Unable to handle kernel NULL pointer dereference at virtual address 00000000 [ 0.919653] pgd = ffffff80095b2000 [ 0.919958] [00000000] *pgd=00000000f7ffe003, *pud=00000000f7ffe003, *pmd=0000000000000000 [ 0.920722] Internal error: Oops: 96000045 [#1] PREEMPT SMP [ 0.921220] Modules linked in: [ 0.921509] CPU: 4 PID: 1 Comm: swapper/0 Not tainted 4.4.194 #8 [ 0.922041] Hardware name: rockchip,rk3399-excavator-edp (DT) [ 0.922551] task: ffffffc00a368000 task.stack: ffffffc00a344000 [ 0.923080] PC is at ion_map_iommu+0x160/0x2c4 [ 0.923478] LR is at ion_map_iommu+0x148/0x2c4 Change-Id: I74837f7f7af2b62915af70ecf0be2f621484284f Signed-off-by: Jianqun Xu <jay.xu@rock-chips.com>
1 parent ba30a52 commit 3610b20

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

drivers/video/rockchip/vcodec/vcodec_service.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3021,6 +3021,8 @@ static int vcodec_subdev_probe(struct platform_device *pdev,
30213021
list_session);
30223022
const char *name = np->name;
30233023
char mmu_dev_dts_name[40];
3024+
dma_addr_t iova = -1;
3025+
unsigned long size = 0;
30243026

30253027
dev_info(dev, "probe device");
30263028

@@ -3132,8 +3134,8 @@ static int vcodec_subdev_probe(struct platform_device *pdev,
31323134
}
31333135

31343136
vcodec_iommu_map_iommu(data->iommu_info, session,
3135-
data->pa_hdl, NULL, NULL);
3136-
data->pa_iova = (unsigned long)-1;
3137+
data->pa_hdl, &iova, &size);
3138+
data->pa_iova = iova;
31373139
vcodec_exit_mode(data);
31383140

31393141
hw_info = data->hw_info;

0 commit comments

Comments
 (0)