Commit dfd0287b authored Nov 22, 2022 by Liang He Committed by Alex Deucher Nov 29, 2022

drm/amdgpu: Fix potential double free and null pointer dereference



In amdgpu_get_xgmi_hive(), we should not call kfree() after
kobject_put() as the PUT will call kfree().

In amdgpu_device_ip_init(), we need to check the returned *hive*
which can be NULL before we dereference it.

Signed-off-by: Liang He <windhl@126.com>
Reviewed-by: Luben Tuikov <luben.tuikov@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

parent 2c83e3fd

drivers/gpu/drm/amd/amdgpu/amdgpu_device.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -2473,6 +2473,11 @@ static int amdgpu_device_ip_init(struct amdgpu_device *adev)
		if (!amdgpu_sriov_vf(adev)) {
		struct amdgpu_hive_info *hive = amdgpu_get_xgmi_hive(adev);

		if (WARN_ON(!hive)) {
		r = -ENOENT;
		goto init_failed;
		}

		if (!hive->reset_domain \|\|
		!amdgpu_reset_get_reset_domain(hive->reset_domain)) {
		r = -ENOENT;

drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c

+0 −2

Original line number	Diff line number	Diff line
		@@ -386,7 +386,6 @@ struct amdgpu_hive_info amdgpu_get_xgmi_hive(struct amdgpu_device adev)
		if (ret) {
		dev_err(adev->dev, "XGMI: failed initializing kobject for xgmi hive\n");
		kobject_put(&hive->kobj);
		kfree(hive);
		hive = NULL;
		goto pro_end;
		}
		@@ -410,7 +409,6 @@ struct amdgpu_hive_info amdgpu_get_xgmi_hive(struct amdgpu_device adev)
		dev_err(adev->dev, "XGMI: failed initializing reset domain for xgmi hive\n");
		ret = -ENOMEM;
		kobject_put(&hive->kobj);
		kfree(hive);
		hive = NULL;
		goto pro_end;
		}