video: tegra: host: Do not access cmdbuf_ext if NULL
Terje Bergstrom [Thu, 6 Feb 2014 09:18:03 +0000 (11:18 +0200)]
Fix dereferencing cmdbuf_ext even when it's NULL.

Bug 1452279
Bug 1452227

Change-Id: Iabd98ea6e6aab0b2cf8e04287d43361dee9aa699
Signed-off-by: Terje Bergstrom <tbergstrom@nvidia.com>
Signed-off-by: Naveen Kumar S <nkumars@nvidia.com>
Reviewed-on: http://git-master/r/364298
(cherry picked from commit 3d20989565ab3d34dea52f49bb3928d33427dca9)
Reviewed-on: http://git-master/r/377630
GVS: Gerrit_Virtual_Submit
Reviewed-by: Eric Brower <ebrower@nvidia.com>
Reviewed-by: Matthew Pedro <mapedro@nvidia.com>

drivers/video/tegra/host/bus_client.c

index 044597a..030e28c 100644 (file)
@@ -435,8 +435,10 @@ static int nvhost_ioctl_channel_submit(struct nvhost_channel_userctx *ctx,
                if (err)
                        goto fail;
 
-               err = copy_from_user(&cmdbuf_ext,
-                               cmdbuf_exts + i, sizeof(cmdbuf_ext));
+               cmdbuf_ext.pre_fence = -1;
+               if (cmdbuf_exts)
+                       err = copy_from_user(&cmdbuf_ext,
+                                       cmdbuf_exts + i, sizeof(cmdbuf_ext));
                if (err)
                        cmdbuf_ext.pre_fence = -1;