Commit 418b4e39 authored by Le Ma's avatar Le Ma Committed by Alex Deucher
Browse files

drm/amdgpu: fix array out of bounds accesses for mes sw_fini 



The mes.fw[] is per-pipe resource shared accross xcc inst.
And enlarge hung_queue array to max inst_pipes.

Signed-off-by: default avatarLe Ma <le.ma@amd.com>
Reviewed-by: default avatarHawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
parent cbbf3339

drivers/gpu/drm/amd/amdgpu/amdgpu_mes.h

+3 −3
Original line number Diff line number Diff line
@@ -159,9 +159,9 @@ struct amdgpu_mes { 


	int				hung_queue_db_array_size;

	int				hung_queue_hqd_info_offset;

	struct amdgpu_bo		*hung_queue_db_array_gpu_obj[AMDGPU_MAX_MES_PIPES];

	uint64_t			hung_queue_db_array_gpu_addr[AMDGPU_MAX_MES_PIPES];

	void				*hung_queue_db_array_cpu_addr[AMDGPU_MAX_MES_PIPES];

	struct amdgpu_bo		*hung_queue_db_array_gpu_obj[AMDGPU_MAX_MES_INST_PIPES];

	uint64_t			hung_queue_db_array_gpu_addr[AMDGPU_MAX_MES_INST_PIPES];

	void				*hung_queue_db_array_cpu_addr[AMDGPU_MAX_MES_INST_PIPES];



	/* cooperative dispatch */

	bool                enable_coop_mode;

drivers/gpu/drm/amd/amdgpu/mes_v12_1.c

+3 −1
Original line number Diff line number Diff line
@@ -1611,7 +1611,6 @@ static int mes_v12_1_sw_fini(struct amdgpu_ip_block *ip_block) 
			amdgpu_bo_free_kernel(&adev->mes.eop_gpu_obj[inst],

					      &adev->mes.eop_gpu_addr[inst],

					      NULL);

			amdgpu_ucode_release(&adev->mes.fw[inst]);



			if (adev->enable_uni_mes || pipe == AMDGPU_MES_SCHED_PIPE) {

				amdgpu_bo_free_kernel(&adev->mes.ring[inst].mqd_obj,
@@ -1622,6 +1621,9 @@ static int mes_v12_1_sw_fini(struct amdgpu_ip_block *ip_block) 
		}

	}



	for (pipe = 0; pipe < AMDGPU_MAX_MES_PIPES; pipe++)

		amdgpu_ucode_release(&adev->mes.fw[pipe]);



	for (xcc_id = 0; xcc_id < num_xcc; xcc_id++) {

		if (!adev->enable_uni_mes) {

			amdgpu_bo_free_kernel(&adev->gfx.kiq[xcc_id].ring.mqd_obj,