diff mbox

drm/amdgpu: Fix a NULL deref in amdgpu_vm_add_prt_cb()

Message ID 20170403184139.GA12398@mwanda (mailing list archive)
State New, archived
Headers show

Commit Message

Dan Carpenter April 3, 2017, 6:41 p.m. UTC
We accidentally dereference "cb" if the kmalloc() fails.

Fixes: 451bc8eb8fe6 ("drm/amdgpu: fix PRT teardown on VM fini v3")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Comments

Harry Wentland April 3, 2017, 6:53 p.m. UTC | #1
Reviewed-by: Harry Wentland <harry.wentland@amd.com>

Harry

On 2017-04-03 02:41 PM, Dan Carpenter wrote:
> We accidentally dereference "cb" if the kmalloc() fails.
>
> Fixes: 451bc8eb8fe6 ("drm/amdgpu: fix PRT teardown on VM fini v3")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
> index 0235d7933efd..45a1bcfc41f7 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
> @@ -1518,7 +1518,7 @@ static void amdgpu_vm_add_prt_cb(struct amdgpu_device *adev,
>  		if (fence)
>  			dma_fence_wait(fence, false);
>
> -		amdgpu_vm_prt_put(cb->adev);
> +		amdgpu_vm_prt_put(adev);
>  	} else {
>  		cb->adev = adev;
>  		if (!fence || dma_fence_add_callback(fence, &cb->cb,
> _______________________________________________
> dri-devel mailing list
> dri-devel@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/dri-devel
>
Alex Deucher April 3, 2017, 8:36 p.m. UTC | #2
On Mon, Apr 3, 2017 at 2:53 PM, Harry Wentland <harry.wentland@amd.com> wrote:
> Reviewed-by: Harry Wentland <harry.wentland@amd.com>
>
> Harry
>

Applied.  thanks!

Alex

>
> On 2017-04-03 02:41 PM, Dan Carpenter wrote:
>>
>> We accidentally dereference "cb" if the kmalloc() fails.
>>
>> Fixes: 451bc8eb8fe6 ("drm/amdgpu: fix PRT teardown on VM fini v3")
>> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>>
>> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
>> b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
>> index 0235d7933efd..45a1bcfc41f7 100644
>> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
>> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
>> @@ -1518,7 +1518,7 @@ static void amdgpu_vm_add_prt_cb(struct
>> amdgpu_device *adev,
>>                 if (fence)
>>                         dma_fence_wait(fence, false);
>>
>> -               amdgpu_vm_prt_put(cb->adev);
>> +               amdgpu_vm_prt_put(adev);
>>         } else {
>>                 cb->adev = adev;
>>                 if (!fence || dma_fence_add_callback(fence, &cb->cb,
>> _______________________________________________
>> dri-devel mailing list
>> dri-devel@lists.freedesktop.org
>> https://lists.freedesktop.org/mailman/listinfo/dri-devel
>>
> _______________________________________________
> amd-gfx mailing list
> amd-gfx@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/amd-gfx
Christian König April 4, 2017, 6:34 a.m. UTC | #3
Am 03.04.2017 um 22:36 schrieb Alex Deucher:
> On Mon, Apr 3, 2017 at 2:53 PM, Harry Wentland <harry.wentland@amd.com> wrote:
>> Reviewed-by: Harry Wentland <harry.wentland@amd.com>
>>
>> Harry
>>
> Applied.  thanks!

Nice catch, Reviewed-by: Christian König <christian.koenig@amd.com> if 
Alex still wants to add that.

Christian.

>
> Alex
>
>> On 2017-04-03 02:41 PM, Dan Carpenter wrote:
>>> We accidentally dereference "cb" if the kmalloc() fails.
>>>
>>> Fixes: 451bc8eb8fe6 ("drm/amdgpu: fix PRT teardown on VM fini v3")
>>> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>>>
>>> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
>>> b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
>>> index 0235d7933efd..45a1bcfc41f7 100644
>>> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
>>> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
>>> @@ -1518,7 +1518,7 @@ static void amdgpu_vm_add_prt_cb(struct
>>> amdgpu_device *adev,
>>>                  if (fence)
>>>                          dma_fence_wait(fence, false);
>>>
>>> -               amdgpu_vm_prt_put(cb->adev);
>>> +               amdgpu_vm_prt_put(adev);
>>>          } else {
>>>                  cb->adev = adev;
>>>                  if (!fence || dma_fence_add_callback(fence, &cb->cb,
>>> _______________________________________________
>>> dri-devel mailing list
>>> dri-devel@lists.freedesktop.org
>>> https://lists.freedesktop.org/mailman/listinfo/dri-devel
>>>
>> _______________________________________________
>> amd-gfx mailing list
>> amd-gfx@lists.freedesktop.org
>> https://lists.freedesktop.org/mailman/listinfo/amd-gfx
diff mbox

Patch

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index 0235d7933efd..45a1bcfc41f7 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -1518,7 +1518,7 @@  static void amdgpu_vm_add_prt_cb(struct amdgpu_device *adev,
 		if (fence)
 			dma_fence_wait(fence, false);
 
-		amdgpu_vm_prt_put(cb->adev);
+		amdgpu_vm_prt_put(adev);
 	} else {
 		cb->adev = adev;
 		if (!fence || dma_fence_add_callback(fence, &cb->cb,