The xen_drm_front_gem_get_sg_table() function is supposed to return error pointer. The current code, would trigger a NULL dereference in drm_gem_map_dma_buf().
Fixes: c575b7eeb89f ("drm/xen-front: Add support for Xen PV display frontend") Signed-off-by: Dan Carpenter dan.carpenter@oracle.com
diff --git a/drivers/gpu/drm/xen/xen_drm_front_gem.c b/drivers/gpu/drm/xen/xen_drm_front_gem.c index c85bfe7571cb..4507bc03ed8f 100644 --- a/drivers/gpu/drm/xen/xen_drm_front_gem.c +++ b/drivers/gpu/drm/xen/xen_drm_front_gem.c @@ -179,7 +179,7 @@ struct sg_table *xen_drm_front_gem_get_sg_table(struct drm_gem_object *gem_obj) struct xen_gem_object *xen_obj = to_xen_gem_obj(gem_obj);
if (!xen_obj->pages) - return NULL; + return ERR_PTR(-EINVAL);
return drm_prime_pages_to_sg(xen_obj->pages, xen_obj->num_pages); }