[PATCH] drm/amdgpu: prevent memory leaks in AMDGPU_CS ioctl

[Christian König]

Am 21.08.19 um 16:29 schrieb Haehnle, Nicolai:
> Error out if the AMDGPU_CS ioctl is called with multiple SYNCOBJ_OUT and/or
> TIMELINE_SIGNAL chunks, since otherwise the last chunk wins while the
> allocated array as well as the reference counts of sync objects are leaked.
>
> Signed-off-by: Nicolai Hähnle <nicolai.haehnle at amd.com>

We could shorten the function names at some point as well, but that's 
unrelated to this patch.

Reviewed-by: Christian König <christian.koenig at amd.com>

> ---
>   drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 9 +++++++--
>   1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> index def029ab5657..fd95b586b590 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> @@ -1134,20 +1134,23 @@ static int amdgpu_cs_process_syncobj_out_dep(struct amdgpu_cs_parser *p,
>   					     struct amdgpu_cs_chunk *chunk)
>   {
>   	struct drm_amdgpu_cs_chunk_sem *deps;
>   	unsigned num_deps;
>   	int i;
>   
>   	deps = (struct drm_amdgpu_cs_chunk_sem *)chunk->kdata;
>   	num_deps = chunk->length_dw * 4 /
>   		sizeof(struct drm_amdgpu_cs_chunk_sem);
>   
> +	if (p->post_deps)
> +		return -EINVAL;
> +
>   	p->post_deps = kmalloc_array(num_deps, sizeof(*p->post_deps),
>   				     GFP_KERNEL);
>   	p->num_post_deps = 0;
>   
>   	if (!p->post_deps)
>   		return -ENOMEM;
>   
>   
>   	for (i = 0; i < num_deps; ++i) {
>   		p->post_deps[i].syncobj =
> @@ -1157,31 +1160,33 @@ static int amdgpu_cs_process_syncobj_out_dep(struct amdgpu_cs_parser *p,
>   		p->post_deps[i].chain = NULL;
>   		p->post_deps[i].point = 0;
>   		p->num_post_deps++;
>   	}
>   
>   	return 0;
>   }
>   
>   
>   static int amdgpu_cs_process_syncobj_timeline_out_dep(struct amdgpu_cs_parser *p,
> -						      struct amdgpu_cs_chunk
> -						      *chunk)
> +						      struct amdgpu_cs_chunk *chunk)
>   {
>   	struct drm_amdgpu_cs_chunk_syncobj *syncobj_deps;
>   	unsigned num_deps;
>   	int i;
>   
>   	syncobj_deps = (struct drm_amdgpu_cs_chunk_syncobj *)chunk->kdata;
>   	num_deps = chunk->length_dw * 4 /
>   		sizeof(struct drm_amdgpu_cs_chunk_syncobj);
>   
> +	if (p->post_deps)
> +		return -EINVAL;
> +
>   	p->post_deps = kmalloc_array(num_deps, sizeof(*p->post_deps),
>   				     GFP_KERNEL);
>   	p->num_post_deps = 0;
>   
>   	if (!p->post_deps)
>   		return -ENOMEM;
>   
>   	for (i = 0; i < num_deps; ++i) {
>   		struct amdgpu_cs_post_dep *dep = &p->post_deps[i];
>