1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
|
From c673e7965f627ec996dee585aceee77f9825e671 Mon Sep 17 00:00:00 2001
From: Hawking Zhang <Hawking.Zhang@amd.com>
Date: Tue, 3 Sep 2019 03:16:47 +0800
Subject: [PATCH 0032/1453] drm/amdgpu: set ip specific ras interface pointer
to NULL after free it
to prevent access to dangling pointers
Signed-off-by: Hawking Zhang <Hawking.Zhang@amd.com>
Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
---
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 7 +++++--
drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 8 ++++++--
drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c | 4 +++-
drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c | 4 ++++
drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 8 ++++++--
5 files changed, 24 insertions(+), 7 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
index 42d7ac94a4b1..f48159e78c85 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
@@ -4460,14 +4460,17 @@ static int gfx_v9_0_ecc_late_init(void *handle)
r = amdgpu_irq_get(adev, &adev->gfx.cp_ecc_error_irq, 0);
if (r)
goto late_fini;
- } else
- kfree(adev->gfx.ras_if);
+ } else {
+ r = 0;
+ goto free;
+ }
return 0;
late_fini:
amdgpu_ras_late_fini(adev, adev->gfx.ras_if, &ih_info);
free:
kfree(adev->gfx.ras_if);
+ adev->gfx.ras_if = NULL;
return r;
}
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
index f1300d5f4f87..ba149554b508 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
@@ -799,8 +799,11 @@ static int gmc_v9_0_ecc_late_init(void *handle)
r = amdgpu_irq_get(adev, &adev->gmc.ecc_irq, 0);
if (r)
goto umc_late_fini;
- } else
- kfree(adev->gmc.umc_ras_if);
+ } else {
+ /* free umc ras_if if umc ras is not supported */
+ r = 0;
+ goto free;
+ }
if (adev->mmhub_funcs && adev->mmhub_funcs->ras_late_init) {
r = adev->mmhub_funcs->ras_late_init(adev);
@@ -812,6 +815,7 @@ static int gmc_v9_0_ecc_late_init(void *handle)
amdgpu_ras_late_fini(adev, adev->gmc.umc_ras_if, &umc_ih_info);
free:
kfree(adev->gmc.umc_ras_if);
+ adev->gmc.umc_ras_if = NULL;
return r;
}
diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c
index ab6559a2d5e8..9916a333d9dc 100644
--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c
@@ -639,8 +639,10 @@ static int mmhub_v1_0_ras_late_init(struct amdgpu_device *adev)
mmhub_ih_info.head = mmhub_fs_info.head = *adev->gmc.mmhub_ras_if;
r = amdgpu_ras_late_init(adev, adev->gmc.mmhub_ras_if,
&mmhub_fs_info, &mmhub_ih_info);
- if (r || !amdgpu_ras_is_supported(adev, adev->gmc.mmhub_ras_if->block))
+ if (r || !amdgpu_ras_is_supported(adev, adev->gmc.mmhub_ras_if->block)) {
kfree(adev->gmc.mmhub_ras_if);
+ adev->gmc.mmhub_ras_if = NULL;
+ }
return r;
}
diff --git a/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c b/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c
index 27eeab143ad7..f25c6a9c6718 100644
--- a/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c
+++ b/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c
@@ -507,6 +507,9 @@ static int nbio_v7_4_ras_late_init(struct amdgpu_device *adev)
r = amdgpu_irq_get(adev, &adev->nbio.ras_err_event_athub_irq, 0);
if (r)
goto late_fini;
+ } else {
+ r = 0;
+ goto free;
}
return 0;
@@ -514,6 +517,7 @@ static int nbio_v7_4_ras_late_init(struct amdgpu_device *adev)
amdgpu_ras_late_fini(adev, adev->nbio.ras_if, &ih_info);
free:
kfree(adev->nbio.ras_if);
+ adev->nbio.ras_if = NULL;
return r;
}
diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c
index ca93ae593c6e..27791478a618 100644
--- a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c
@@ -1729,14 +1729,18 @@ static int sdma_v4_0_late_init(void *handle)
if (r)
goto late_fini;
}
- } else
- kfree(adev->sdma.ras_if);
+ } else {
+ /* free sdma ras_if if sdma ras is not supported */
+ r = 0;
+ goto free;
+ }
return 0;
late_fini:
amdgpu_ras_late_fini(adev, adev->sdma.ras_if, &ih_info);
free:
kfree(adev->sdma.ras_if);
+ adev->sdma.ras_if = NULL;
return r;
}
--
2.17.1
|
