Commit c86ad391 authored by Philip Yang's avatar Philip Yang Committed by Alex Deucher
Browse files

drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer 



Pass pointer reference to amdgpu_bo_unref to clear the correct pointer,
otherwise amdgpu_bo_unref clear the local variable, the original pointer
not set to NULL, this could cause use-after-free bug.

Signed-off-by: default avatarPhilip Yang <Philip.Yang@amd.com>
Reviewed-by: default avatarFelix Kuehling <felix.kuehling@amd.com>
Acked-by: default avatarChristian König <christian.koenig@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
parent f9e292cb

drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c

+7 −7
Original line number Diff line number Diff line
@@ -364,15 +364,15 @@ int amdgpu_amdkfd_alloc_gtt_mem(struct amdgpu_device *adev, size_t size, 
	return r;

}



void amdgpu_amdkfd_free_gtt_mem(struct amdgpu_device *adev, void *mem_obj)

void amdgpu_amdkfd_free_gtt_mem(struct amdgpu_device *adev, void **mem_obj)

{

	struct amdgpu_bo *bo = (struct amdgpu_bo *) mem_obj;

	struct amdgpu_bo **bo = (struct amdgpu_bo **) mem_obj;



	amdgpu_bo_reserve(bo, true);

	amdgpu_bo_kunmap(bo);

	amdgpu_bo_unpin(bo);

	amdgpu_bo_unreserve(bo);

	amdgpu_bo_unref(&(bo));

	amdgpu_bo_reserve(*bo, true);

	amdgpu_bo_kunmap(*bo);

	amdgpu_bo_unpin(*bo);

	amdgpu_bo_unreserve(*bo);

	amdgpu_bo_unref(bo);

}



int amdgpu_amdkfd_alloc_gws(struct amdgpu_device *adev, size_t size,

drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h

+1 −1
Original line number Diff line number Diff line
@@ -235,7 +235,7 @@ int amdgpu_amdkfd_bo_validate_and_fence(struct amdgpu_bo *bo, 
int amdgpu_amdkfd_alloc_gtt_mem(struct amdgpu_device *adev, size_t size,

				void **mem_obj, uint64_t *gpu_addr,

				void **cpu_ptr, bool mqd_gfx9);

void amdgpu_amdkfd_free_gtt_mem(struct amdgpu_device *adev, void *mem_obj);

void amdgpu_amdkfd_free_gtt_mem(struct amdgpu_device *adev, void **mem_obj);

int amdgpu_amdkfd_alloc_gws(struct amdgpu_device *adev, size_t size,

				void **mem_obj);

void amdgpu_amdkfd_free_gws(struct amdgpu_device *adev, void *mem_obj);

drivers/gpu/drm/amd/amdkfd/kfd_chardev.c

+1 −1
Original line number Diff line number Diff line
@@ -423,7 +423,7 @@ static int kfd_ioctl_create_queue(struct file *filep, struct kfd_process *p, 


err_create_queue:

	if (wptr_bo)

		amdgpu_amdkfd_free_gtt_mem(dev->adev, wptr_bo);

		amdgpu_amdkfd_free_gtt_mem(dev->adev, (void **)&wptr_bo);

err_wptr_map_gart:

err_bind_process:

err_pdd:

drivers/gpu/drm/amd/amdkfd/kfd_device.c

+2 −2
Original line number Diff line number Diff line
@@ -907,7 +907,7 @@ bool kgd2kfd_device_init(struct kfd_dev *kfd, 
kfd_doorbell_error:

	kfd_gtt_sa_fini(kfd);

kfd_gtt_sa_init_error:

	amdgpu_amdkfd_free_gtt_mem(kfd->adev, kfd->gtt_mem);

	amdgpu_amdkfd_free_gtt_mem(kfd->adev, &kfd->gtt_mem);

alloc_gtt_mem_failure:

	dev_err(kfd_device,

		"device %x:%x NOT added due to errors\n",
@@ -925,7 +925,7 @@ void kgd2kfd_device_exit(struct kfd_dev *kfd) 
		kfd_doorbell_fini(kfd);

		ida_destroy(&kfd->doorbell_ida);

		kfd_gtt_sa_fini(kfd);

		amdgpu_amdkfd_free_gtt_mem(kfd->adev, kfd->gtt_mem);

		amdgpu_amdkfd_free_gtt_mem(kfd->adev, &kfd->gtt_mem);

	}



	kfree(kfd);

drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c

+1 −1
Original line number Diff line number Diff line
@@ -2621,7 +2621,7 @@ static void deallocate_hiq_sdma_mqd(struct kfd_node *dev, 
{

	WARN(!mqd, "No hiq sdma mqd trunk to free");



	amdgpu_amdkfd_free_gtt_mem(dev->adev, mqd->gtt_mem);

	amdgpu_amdkfd_free_gtt_mem(dev->adev, &mqd->gtt_mem);

}



void device_queue_manager_uninit(struct device_queue_manager *dqm)