mirror/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

drm/amdkfd: potential NULL dereference in kfd_set/reset_event()

Browse Source 
If lookup_event_by_id() returns a NULL "ev" pointer then the
spin_lock(&ev->lock) will crash.  This was detected by Smatch:

    drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_events.c:644 kfd_set_event()
    error: we previously assumed 'ev' could be null (see line 639)

Fixes: 5273e82c5f ("drm/amdkfd: Improve concurrency of event handling")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
This commit is contained in:
Dan Carpenter
2022-04-13 10:36:40 +03:00
committed by Alex Deucher
parent 46d18d510d
commit abb5bc5949
1 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
drivers/gpu/drm/amd/amdkfd/kfd_events.c
View File

@@ -633,14 +633,19 @@ int kfd_set_event(struct kfd_process *p, uint32_t event_id)
rcu_read_lock();
ev = lookup_event_by_id(p, event_id);
if (!ev) {
ret = -EINVAL;
goto unlock_rcu;
}
spin_lock(&ev->lock);
if (ev && event_can_be_cpu_signaled(ev))
if (event_can_be_cpu_signaled(ev))
set_event(ev);
else
ret = -EINVAL;
spin_unlock(&ev->lock);
unlock_rcu:
rcu_read_unlock();
return ret;
}
@@ -659,14 +664,19 @@ int kfd_reset_event(struct kfd_process *p, uint32_t event_id)
rcu_read_lock();
ev = lookup_event_by_id(p, event_id);
if (!ev) {
ret = -EINVAL;
goto unlock_rcu;
}
spin_lock(&ev->lock);
if (ev && event_can_be_cpu_signaled(ev))
if (event_can_be_cpu_signaled(ev))
reset_event(ev);
else
ret = -EINVAL;
spin_unlock(&ev->lock);
unlock_rcu:
rcu_read_unlock();
return ret;