Commit 480ad5f6 authored by Bart Van Assche's avatar Bart Van Assche Committed by Alex Deucher
Browse files

drm/amdgpu: Fix locking bugs in error paths 



Do not unlock psp->ras_context.mutex if it has not been locked. This has
been detected by the Clang thread-safety analyzer.

Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: YiPeng Chai <YiPeng.Chai@amd.com>
Cc: Hawking Zhang <Hawking.Zhang@amd.com>
Cc: amd-gfx@lists.freedesktop.org
Fixes: b3fb79cd ("drm/amdgpu: add mutex to protect ras shared memory")
Acked-by: default avatarChristian König <christian.koenig@amd.com>
Signed-off-by: default avatarBart Van Assche <bvanassche@acm.org>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 6fa01b43)
parent 5e0bcc7b

drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c

+7 −5
Original line number Diff line number Diff line
@@ -332,13 +332,13 @@ static ssize_t ta_if_invoke_debugfs_write(struct file *fp, const char *buf, size 
	if (!context || !context->initialized) {

		dev_err(adev->dev, "TA is not initialized\n");

		ret = -EINVAL;

		goto err_free_shared_buf;

		goto free_shared_buf;

	}



	if (!psp->ta_funcs || !psp->ta_funcs->fn_ta_invoke) {

		dev_err(adev->dev, "Unsupported function to invoke TA\n");

		ret = -EOPNOTSUPP;

		goto err_free_shared_buf;

		goto free_shared_buf;

	}



	context->session_id = ta_id;
@@ -346,7 +346,7 @@ static ssize_t ta_if_invoke_debugfs_write(struct file *fp, const char *buf, size 
	mutex_lock(&psp->ras_context.mutex);

	ret = prep_ta_mem_context(&context->mem_context, shared_buf, shared_buf_len);

	if (ret)

		goto err_free_shared_buf;

		goto unlock;



	ret = psp_fn_ta_invoke(psp, cmd_id);

	if (ret || context->resp_status) {
@@ -354,15 +354,17 @@ static ssize_t ta_if_invoke_debugfs_write(struct file *fp, const char *buf, size 
			ret, context->resp_status);

		if (!ret) {

			ret = -EINVAL;

			goto err_free_shared_buf;

			goto unlock;

		}

	}



	if (copy_to_user((char *)&buf[copy_pos], context->mem_context.shared_buf, shared_buf_len))

		ret = -EFAULT;



err_free_shared_buf:

unlock:

	mutex_unlock(&psp->ras_context.mutex);



free_shared_buf:

	kfree(shared_buf);



	return ret;