Blob Blame History Raw
From 905483d9ea93e05d019664b3cfd078870233faaa Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <tzimmermann@suse.com>
Date: Mon, 20 Feb 2023 10:38:08 +0100
Subject: drm/vmwgfx: Avoid NULL-ptr deref in vmw_cmd_dx_define_query()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Patch-mainline: Never, quick fix for CVE-2022-38096
References: bsc#1203331 CVE-2022-38096

See bsc#1203331.

Suggested-by: Michal Koutný <mkoutny@suse.com>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.com>
Acked-by: Thomas Zimmermann <tzimmermann@suse.com>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -1405,7 +1405,7 @@ static int vmw_cmd_dx_define_query(struc
 	struct vmw_resource *cotable_res;
 
 
-	if (ctx_node == NULL) {
+	if (!ctx_node || !ctx_node->res) {
 		DRM_ERROR("DX Context not set for query.\n");
 		return -EINVAL;
 	}