TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

drm/amdgpu: Fix potential double free and null pointer dereference

Browse Source 
In amdgpu_get_xgmi_hive(), we should not call kfree() after
kobject_put() as the PUT will call kfree().

In amdgpu_device_ip_init(), we need to check the returned *hive*
which can be NULL before we dereference it.

Signed-off-by: Liang He <windhl@126.com>
Reviewed-by: Luben Tuikov <luben.tuikov@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
This commit is contained in:
Liang He
2022-11-22 12:28:49 +08:00
committed by Alex Deucher
parent 2c83e3fd92
commit dfd0287bd3
2 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+5
View File
@@ -2473,6 +2473,11 @@ static int amdgpu_device_ip_init(struct amdgpu_device *adev)
if (!amdgpu_sriov_vf(adev)) { if (!amdgpu_sriov_vf(adev)) {
struct amdgpu_hive_info *hive = amdgpu_get_xgmi_hive(adev); struct amdgpu_hive_info *hive = amdgpu_get_xgmi_hive(adev);
if (WARN_ON(!hive)) {
r = -ENOENT;
goto init_failed;
}
if (!hive->reset_domain || if (!hive->reset_domain ||
!amdgpu_reset_get_reset_domain(hive->reset_domain)) { !amdgpu_reset_get_reset_domain(hive->reset_domain)) {
r = -ENOENT; r = -ENOENT;
drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c
-2
View File
@@ -386,7 +386,6 @@ struct amdgpu_hive_info *amdgpu_get_xgmi_hive(struct amdgpu_device *adev)
if (ret) { if (ret) {
dev_err(adev->dev, "XGMI: failed initializing kobject for xgmi hive\n"); dev_err(adev->dev, "XGMI: failed initializing kobject for xgmi hive\n");
kobject_put(&hive->kobj); kobject_put(&hive->kobj);
kfree(hive);
hive = NULL; hive = NULL;
goto pro_end; goto pro_end;
} }
@@ -410,7 +409,6 @@ struct amdgpu_hive_info *amdgpu_get_xgmi_hive(struct amdgpu_device *adev)
dev_err(adev->dev, "XGMI: failed initializing reset domain for xgmi hive\n"); dev_err(adev->dev, "XGMI: failed initializing reset domain for xgmi hive\n");
ret = -ENOMEM; ret = -ENOMEM;
kobject_put(&hive->kobj); kobject_put(&hive->kobj);
kfree(hive);
hive = NULL; hive = NULL;
goto pro_end; goto pro_end;
} }