diff options
Diffstat (limited to 'meta-amd-bsp/recipes-kernel/linux/linux-yocto-4.19.8/4374-drm-amdgpu-fix-potential-double-drop-fence-reference.patch')
-rw-r--r-- | meta-amd-bsp/recipes-kernel/linux/linux-yocto-4.19.8/4374-drm-amdgpu-fix-potential-double-drop-fence-reference.patch | 44 |
1 files changed, 44 insertions, 0 deletions
diff --git a/meta-amd-bsp/recipes-kernel/linux/linux-yocto-4.19.8/4374-drm-amdgpu-fix-potential-double-drop-fence-reference.patch b/meta-amd-bsp/recipes-kernel/linux/linux-yocto-4.19.8/4374-drm-amdgpu-fix-potential-double-drop-fence-reference.patch new file mode 100644 index 00000000..b17f6413 --- /dev/null +++ b/meta-amd-bsp/recipes-kernel/linux/linux-yocto-4.19.8/4374-drm-amdgpu-fix-potential-double-drop-fence-reference.patch @@ -0,0 +1,44 @@ +From 08d4288d57725c283f2c0272870ee3e95788eb54 Mon Sep 17 00:00:00 2001 +From: Pan Bian <bianpan2016@163.com> +Date: Wed, 6 Nov 2019 17:14:45 +0800 +Subject: [PATCH 4374/4736] drm/amdgpu: fix potential double drop fence + reference +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The object fence is not set to NULL after its reference is dropped. As a +result, its reference may be dropped again if error occurs after that, +which may lead to a use after free bug. To avoid the issue, fence is +explicitly set to NULL after dropping its reference. + +Acked-by: Christian König <christian.koenig@amd.com> +Signed-off-by: Pan Bian <bianpan2016@163.com> +Signed-off-by: Alex Deucher <alexander.deucher@amd.com> +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_test.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c +index 8904e62dca7a..41d3142ef3cf 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c +@@ -138,6 +138,7 @@ static void amdgpu_do_test_moves(struct amdgpu_device *adev) + } + + dma_fence_put(fence); ++ fence = NULL; + + r = amdgpu_bo_kmap(vram_obj, &vram_map); + if (r) { +@@ -183,6 +184,7 @@ static void amdgpu_do_test_moves(struct amdgpu_device *adev) + } + + dma_fence_put(fence); ++ fence = NULL; + + r = amdgpu_bo_kmap(gtt_obj[i], >t_map); + if (r) { +-- +2.17.1 + |