drm/amdgpu: Fix a NULL deref in amdgpu_vm_add_prt_cb()

PATCH Applied Dan Carpenter 4 participants 4 messages Apr 3, 2017 – Apr 4, 2017

Subsystems (3)

DRM drivers Kernel janitors Radeon and amdgpu DRM drivers

lore

Share & tools

lore

Dan Carpenter

author

2017-04-03 18:41 UTC #0 lore raw

PATCH 1/1 drm/amdgpu: Fix a NULL deref in amdgpu_vm_add_prt_cb()

We accidentally dereference "cb" if the kmalloc() fails.

Fixes 451bc8eb8fe6 ("drm/amdgpu: fix PRT teardown on VM fini v3")

Signed-off-by Dan Carpenter <[email protected]>

drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +1 -1

index 0235d7933efd..45a1bcfc41f7 100644
@@ -1518,7 +1518,7 @@ static void amdgpu_vm_add_prt_cb(struct amdgpu_device *adev,
 		if (fence)
 			dma_fence_wait(fence, false);
 
-		amdgpu_vm_prt_put(cb->adev);
+		amdgpu_vm_prt_put(adev);
 	} else {
 		cb->adev = adev;
 		if (!fence || dma_fence_add_callback(fence, &cb->cb,

_______________________________________________
dri-devel mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Harry Wentland

Reviewed-by on v1 1/1

2017-04-03 18:53 UTC #1 lore raw

Reviewed-by Harry Wentland <[email protected]>

Harry

Quoted 18 lines · Dan Carpenter

We accidentally dereference "cb" if the kmalloc() fails.
Fixes 451bc8eb8fe6 ("drm/amdgpu: fix PRT teardown on VM fini v3")
Signed-off-by Dan Carpenter <[email protected]>
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +1 -1
index 0235d7933efd..45a1bcfc41f7 100644
@@ -1518,7 +1518,7 @@ static void amdgpu_vm_add_prt_cb(struct amdgpu_device *adev,
 		if (fence)
 			dma_fence_wait(fence, false);
 
-		amdgpu_vm_prt_put(cb->adev);
+		amdgpu_vm_prt_put(adev);
 	} else {
 		cb->adev = adev;
 		if (!fence || dma_fence_add_callback(fence, &cb->cb,

Quoted 5 lines

_______________________________________________
dri-devel mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/dri-devel

_______________________________________________
amd-gfx mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/amd-gfx

Alex Deucher

Applied

2017-04-03 20:36 UTC #2 lore raw

Quoted 4 lines · Harry Wentland

Reviewed-by Harry Wentland <[email protected]>
Harry

Applied. thanks!

Alex

Quoted 32 lines · Dan Carpenter

Quoted 21 lines
We accidentally dereference "cb" if the kmalloc() fails.
Fixes 451bc8eb8fe6 ("drm/amdgpu: fix PRT teardown on VM fini v3")
Signed-off-by Dan Carpenter <[email protected]>
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +1 -1
index 0235d7933efd..45a1bcfc41f7 100644
@@ -1518,7 +1518,7 @@ static void amdgpu_vm_add_prt_cb(struct
 amdgpu_device *adev,
                if (fence)
                        dma_fence_wait(fence, false);
 
-               amdgpu_vm_prt_put(cb->adev);
+               amdgpu_vm_prt_put(adev);
        } else {
                cb->adev = adev;
                if (!fence || dma_fence_add_callback(fence, &cb->cb,
Quoted 5 lines
_______________________________________________
dri-devel mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/dri-devel
_______________________________________________
amd-gfx mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/amd-gfx

Christian König

maintainer

2017-04-04 06:34 UTC #3 lore raw

Am 03.04.2017 um 22:36 schrieb Alex Deucher:

Quoted 6 lines · Harry Wentland

Quoted 4 lines
Reviewed-by Harry Wentland <[email protected]>
Harry
Applied. thanks!

Nice catch, Reviewed-by: Christian König <[email protected]> if Alex still wants to add that.

Christian.

Quoted 33 lines

Alex
Quoted 30 lines · Dan Carpenter
Quoted 20 lines
We accidentally dereference "cb" if the kmalloc() fails.
Fixes 451bc8eb8fe6 ("drm/amdgpu: fix PRT teardown on VM fini v3")
Signed-off-by Dan Carpenter <[email protected]>
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +1 -1
index 0235d7933efd..45a1bcfc41f7 100644
@@ -1518,7 +1518,7 @@ static void amdgpu_vm_add_prt_cb(struct
 amdgpu_device *adev,
                 if (fence)
                         dma_fence_wait(fence, false);
 
-               amdgpu_vm_prt_put(cb->adev);
+               amdgpu_vm_prt_put(adev);
         } else {
                 cb->adev = adev;
                 if (!fence || dma_fence_add_callback(fence, &cb->cb,
Quoted 5 lines
_______________________________________________
dri-devel mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/dri-devel
_______________________________________________
amd-gfx mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/amd-gfx