Commit a93b1020 authored by Pierre-Eric Pelloux-Prayer's avatar Pierre-Eric Pelloux-Prayer Committed by Alex Deucher
Browse files

drm/amdgpu: don't access invalid sched 



Since 2320c9e6 ("drm/sched: memset() 'job' in drm_sched_job_init()")
accessing job->base.sched can produce unexpected results as the initialisation
of (*job)->base.sched done in amdgpu_job_alloc is overwritten by the
memset.

This commit fixes an issue when a CS would fail validation and would
be rejected after job->num_ibs is incremented. In this case,
amdgpu_ib_free(ring->adev, ...) will be called, which would crash the
machine because the ring value is bogus.

To fix this, pass a NULL pointer to amdgpu_ib_free(): we can do this
because the device is actually not used in this function.

The next commit will remove the ring argument completely.

Fixes: 2320c9e6 ("drm/sched: memset() 'job' in drm_sched_job_init()")
Signed-off-by: default avatarPierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com>
Reviewed-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Reviewed-by: default avatarChristian König <christian.koenig@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 2ae520cb)
parent 536ae08d

drivers/gpu/drm/amd/amdgpu/amdgpu_job.c

+1 −2
Original line number Diff line number Diff line
@@ -255,7 +255,6 @@ void amdgpu_job_set_resources(struct amdgpu_job *job, struct amdgpu_bo *gds, 


void amdgpu_job_free_resources(struct amdgpu_job *job)

{

	struct amdgpu_ring *ring = to_amdgpu_ring(job->base.sched);

	struct dma_fence *f;

	unsigned i;
@@ -268,7 +267,7 @@ void amdgpu_job_free_resources(struct amdgpu_job *job) 
		f = NULL;



	for (i = 0; i < job->num_ibs; ++i)

		amdgpu_ib_free(ring->adev, &job->ibs[i], f);

		amdgpu_ib_free(NULL, &job->ibs[i], f);

}



static void amdgpu_job_free_cb(struct drm_sched_job *s_job)