[PATCH v2] drm/amdgpu: Fix potential double free and null pointer dereference
Luben Tuikov
luben.tuikov at amd.com
Wed Nov 23 00:10:16 UTC 2022
amdgpu_xgmi_hive_type does provide a release method which frees the allocated "hive",
so we don't need a kfree() after a kobject_put().
Reviewed-by: Luben Tuikov <luben.tuikov at amd.com>
Regards,
Luben
On 2022-11-21 23:28, Liang He wrote:
> In amdgpu_get_xgmi_hive(), we should not call kfree() after
> kobject_put() as the PUT will call kfree().
>
> In amdgpu_device_ip_init(), we need to check the returned *hive*
> which can be NULL before we dereference it.
>
> Signed-off-by: Liang He <windhl at 126.com>
> ---
> v1->v2: we need the extra GET to keep *hive* alive, it is
> my fault to remove the GET in v1.
>
>
> drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 5 +++++
> drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c | 2 --
> 2 files changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
> index f1e9663b4051..00976e15b698 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
> @@ -2462,6 +2462,11 @@ static int amdgpu_device_ip_init(struct amdgpu_device *adev)
> if (!amdgpu_sriov_vf(adev)) {
> struct amdgpu_hive_info *hive = amdgpu_get_xgmi_hive(adev);
>
> + if (WARN_ON(!hive)) {
> + r = -ENOENT;
> + goto init_failed;
> + }
> +
> if (!hive->reset_domain ||
> !amdgpu_reset_get_reset_domain(hive->reset_domain)) {
> r = -ENOENT;
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c
> index 47159e9a0884..4b9e7b050ccd 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c
> @@ -386,7 +386,6 @@ struct amdgpu_hive_info *amdgpu_get_xgmi_hive(struct amdgpu_device *adev)
> if (ret) {
> dev_err(adev->dev, "XGMI: failed initializing kobject for xgmi hive\n");
> kobject_put(&hive->kobj);
> - kfree(hive);
> hive = NULL;
> goto pro_end;
> }
> @@ -410,7 +409,6 @@ struct amdgpu_hive_info *amdgpu_get_xgmi_hive(struct amdgpu_device *adev)
> dev_err(adev->dev, "XGMI: failed initializing reset domain for xgmi hive\n");
> ret = -ENOMEM;
> kobject_put(&hive->kobj);
> - kfree(hive);
> hive = NULL;
> goto pro_end;
> }
More information about the dri-devel
mailing list