shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-09 12:17:12 +09:00
Code Issues Packages Projects Releases Wiki Activity

drm/amdkfd: Fix potential deallocation of previously deallocated memory.

Browse Source 
[ Upstream commit cabbdea1f1 ]

Pointer mqd_mem_obj can be deallocated in kfd_gtt_sa_allocate().
The function then returns non-zero value, which causes the second deallocation.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: d1f8f0d17d ("drm/amdkfd: Move non-sdma mqd allocation out of init_mqd")
Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Daniil Dulov
2023-05-11 04:23:14 -07:00
committed by Greg Kroah-Hartman
parent 245aa7c023
commit a77b80825b
1 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
View File

@@ -113,18 +113,19 @@ static struct kfd_mem_obj *allocate_mqd(struct kfd_dev *kfd,
&(mqd_mem_obj->gtt_mem), &(mqd_mem_obj->gtt_mem),
&(mqd_mem_obj->gpu_addr), &(mqd_mem_obj->gpu_addr),
(void *)&(mqd_mem_obj->cpu_ptr), true); (void *)&(mqd_mem_obj->cpu_ptr), true);
if (retval) {
kfree(mqd_mem_obj);
return NULL;
}
} else { } else {
retval = kfd_gtt_sa_allocate(kfd, sizeof(struct v9_mqd), retval = kfd_gtt_sa_allocate(kfd, sizeof(struct v9_mqd),
&mqd_mem_obj); &mqd_mem_obj);
} if (retval)
return NULL;
if (retval) {
kfree(mqd_mem_obj);
return NULL;
} }
return mqd_mem_obj; return mqd_mem_obj;
} }
static void init_mqd(struct mqd_manager *mm, void **mqd, static void init_mqd(struct mqd_manager *mm, void **mqd,