diff options
Diffstat (limited to 'meta-amd-bsp/recipes-kernel/linux/linux-yocto-4.19.8/3486-drm-amdgpu-prevent-memory-leaks-in-AMDGPU_CS-ioctl.patch')
| -rw-r--r-- | meta-amd-bsp/recipes-kernel/linux/linux-yocto-4.19.8/3486-drm-amdgpu-prevent-memory-leaks-in-AMDGPU_CS-ioctl.patch | 55 |
1 files changed, 55 insertions, 0 deletions
diff --git a/meta-amd-bsp/recipes-kernel/linux/linux-yocto-4.19.8/3486-drm-amdgpu-prevent-memory-leaks-in-AMDGPU_CS-ioctl.patch b/meta-amd-bsp/recipes-kernel/linux/linux-yocto-4.19.8/3486-drm-amdgpu-prevent-memory-leaks-in-AMDGPU_CS-ioctl.patch new file mode 100644 index 00000000..e83d45e6 --- /dev/null +++ b/meta-amd-bsp/recipes-kernel/linux/linux-yocto-4.19.8/3486-drm-amdgpu-prevent-memory-leaks-in-AMDGPU_CS-ioctl.patch @@ -0,0 +1,55 @@ +From cfc32ce2925ac6d13c10913c514efaecedb2ecff Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Nicolai=20H=C3=A4hnle?= <nicolai.haehnle@amd.com> +Date: Tue, 20 Aug 2019 15:39:53 +0200 +Subject: [PATCH 3486/4256] drm/amdgpu: prevent memory leaks in AMDGPU_CS ioctl +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Error out if the AMDGPU_CS ioctl is called with multiple SYNCOBJ_OUT and/or +TIMELINE_SIGNAL chunks, since otherwise the last chunk wins while the +allocated array as well as the reference counts of sync objects are leaked. + +Signed-off-by: Nicolai Hähnle <nicolai.haehnle@amd.com> +Reviewed-by: Christian König <christian.koenig@amd.com> +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +index e745432315be..e06702390278 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +@@ -1130,6 +1130,9 @@ static int amdgpu_cs_process_syncobj_out_dep(struct amdgpu_cs_parser *p, + num_deps = chunk->length_dw * 4 / + sizeof(struct drm_amdgpu_cs_chunk_sem); + ++ if (p->post_deps) ++ return -EINVAL; ++ + p->post_deps = kmalloc_array(num_deps, sizeof(*p->post_deps), + GFP_KERNEL); + p->num_post_deps = 0; +@@ -1153,8 +1156,7 @@ static int amdgpu_cs_process_syncobj_out_dep(struct amdgpu_cs_parser *p, + + + static int amdgpu_cs_process_syncobj_timeline_out_dep(struct amdgpu_cs_parser *p, +- struct amdgpu_cs_chunk +- *chunk) ++ struct amdgpu_cs_chunk *chunk) + { + struct drm_amdgpu_cs_chunk_syncobj *syncobj_deps; + unsigned num_deps; +@@ -1164,6 +1166,9 @@ static int amdgpu_cs_process_syncobj_timeline_out_dep(struct amdgpu_cs_parser *p + num_deps = chunk->length_dw * 4 / + sizeof(struct drm_amdgpu_cs_chunk_syncobj); + ++ if (p->post_deps) ++ return -EINVAL; ++ + p->post_deps = kmalloc_array(num_deps, sizeof(*p->post_deps), + GFP_KERNEL); + p->num_post_deps = 0; +-- +2.17.1 + |