hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

drm/amdgpu: prevent memory leaks in AMDGPU_CS ioctl 

Error out if the AMDGPU_CS ioctl is called with multiple SYNCOBJ_OUT and/or
TIMELINE_SIGNAL chunks, since otherwise the last chunk wins while the
allocated array as well as the reference counts of sync objects are leaked.

Signed-off-by: Nicolai Hähnle <nicolai.haehnle@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
This commit is contained in:
Nicolai Hähnle 2019-08-20 15:39:53 +02:00 committed by Alex Deucher
parent 221a2bdbd5
commit 1a701ea924
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
View File

@ -1143,6 +1143,9 @@ static int amdgpu_cs_process_syncobj_out_dep(struct amdgpu_cs_parser *p,
num_deps = chunk->length_dw * 4 / num_deps = chunk->length_dw * 4 /
sizeof(struct drm_amdgpu_cs_chunk_sem); sizeof(struct drm_amdgpu_cs_chunk_sem);
if (p->post_deps)
return -EINVAL;
p->post_deps = kmalloc_array(num_deps, sizeof(*p->post_deps), p->post_deps = kmalloc_array(num_deps, sizeof(*p->post_deps),
GFP_KERNEL); GFP_KERNEL);
p->num_post_deps = 0; p->num_post_deps = 0;
@ -1166,8 +1169,7 @@ static int amdgpu_cs_process_syncobj_out_dep(struct amdgpu_cs_parser *p,
static int amdgpu_cs_process_syncobj_timeline_out_dep(struct amdgpu_cs_parser *p, static int amdgpu_cs_process_syncobj_timeline_out_dep(struct amdgpu_cs_parser *p,
struct amdgpu_cs_chunk struct amdgpu_cs_chunk *chunk)
*chunk)
{ {
struct drm_amdgpu_cs_chunk_syncobj *syncobj_deps; struct drm_amdgpu_cs_chunk_syncobj *syncobj_deps;
unsigned num_deps; unsigned num_deps;
@ -1177,6 +1179,9 @@ static int amdgpu_cs_process_syncobj_timeline_out_dep(struct amdgpu_cs_parser *p
num_deps = chunk->length_dw * 4 / num_deps = chunk->length_dw * 4 /
sizeof(struct drm_amdgpu_cs_chunk_syncobj); sizeof(struct drm_amdgpu_cs_chunk_syncobj);
if (p->post_deps)
return -EINVAL;
p->post_deps = kmalloc_array(num_deps, sizeof(*p->post_deps), p->post_deps = kmalloc_array(num_deps, sizeof(*p->post_deps),
GFP_KERNEL); GFP_KERNEL);
p->num_post_deps = 0; p->num_post_deps = 0;