Commit 34f4495a authored by Quentin Schulz's avatar Quentin Schulz Committed by Tomeu Vizoso
Browse files

accel/rocket: fix unwinding in error path in rocket_probe 



When rocket_core_init() fails (as could be the case with EPROBE_DEFER),
we need to properly unwind by decrementing the counter we just
incremented and if this is the first core we failed to probe, remove the
rocket DRM device with rocket_device_fini() as well. This matches the
logic in rocket_remove(). Failing to properly unwind results in
out-of-bounds accesses.

Fixes: 0810d5ad ("accel/rocket: Add job submission IOCTL")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarQuentin Schulz <quentin.schulz@cherry.de>
Reviewed-by: default avatarTomeu Vizoso <tomeu@tomeuvizoso.net>
Signed-off-by: default avatarTomeu Vizoso <tomeu@tomeuvizoso.net>
Link: https://patch.msgid.link/20251215-rocket-error-path-v1-2-eec3bf29dc3b@cherry.de
parent f509a081

drivers/accel/rocket/rocket_drv.c

+14 −1
Original line number Diff line number Diff line
@@ -13,6 +13,7 @@ 
#include <linux/platform_device.h>

#include <linux/pm_runtime.h>



#include "rocket_device.h"

#include "rocket_drv.h"

#include "rocket_gem.h"

#include "rocket_job.h"
@@ -158,6 +159,8 @@ static const struct drm_driver rocket_drm_driver = { 


static int rocket_probe(struct platform_device *pdev)

{

	int ret;



	if (rdev == NULL) {

		/* First core probing, initialize DRM device. */

		rdev = rocket_device_init(drm_dev, &rocket_drm_driver);
@@ -177,7 +180,17 @@ static int rocket_probe(struct platform_device *pdev) 


	rdev->num_cores++;



	return rocket_core_init(&rdev->cores[core]);

	ret = rocket_core_init(&rdev->cores[core]);

	if (ret) {

		rdev->num_cores--;



		if (rdev->num_cores == 0) {

			rocket_device_fini(rdev);

			rdev = NULL;

		}

	}



	return ret;

}



static void rocket_remove(struct platform_device *pdev)