From d094aea312580f12232b546523dae20f54445469 Mon Sep 17 00:00:00 2001 From: Hawking Zhang Date: Tue, 3 Sep 2019 03:16:47 +0800 Subject: [PATCH] drm/amdgpu: set ip specific ras interface pointer to NULL after free it to prevent access to dangling pointers Signed-off-by: Hawking Zhang Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher --- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 7 +++++-- drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 8 ++++++-- drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c | 4 +++- drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c | 4 ++++ drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 8 ++++++-- 5 files changed, 24 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c index 196a14236445..e40c34d30bd4 100644 --- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c @@ -4444,14 +4444,17 @@ static int gfx_v9_0_ecc_late_init(void *handle) r = amdgpu_irq_get(adev, &adev->gfx.cp_ecc_error_irq, 0); if (r) goto late_fini; - } else - kfree(adev->gfx.ras_if); + } else { + r = 0; + goto free; + } return 0; late_fini: amdgpu_ras_late_fini(adev, adev->gfx.ras_if, &ih_info); free: kfree(adev->gfx.ras_if); + adev->gfx.ras_if = NULL; return r; } diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c index f1300d5f4f87..ba149554b508 100644 --- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c +++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c @@ -799,8 +799,11 @@ static int gmc_v9_0_ecc_late_init(void *handle) r = amdgpu_irq_get(adev, &adev->gmc.ecc_irq, 0); if (r) goto umc_late_fini; - } else - kfree(adev->gmc.umc_ras_if); + } else { + /* free umc ras_if if umc ras is not supported */ + r = 0; + goto free; + } if (adev->mmhub_funcs && adev->mmhub_funcs->ras_late_init) { r = adev->mmhub_funcs->ras_late_init(adev); @@ -812,6 +815,7 @@ umc_late_fini: amdgpu_ras_late_fini(adev, adev->gmc.umc_ras_if, &umc_ih_info); free: kfree(adev->gmc.umc_ras_if); + adev->gmc.umc_ras_if = NULL; return r; } diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c index ab6559a2d5e8..9916a333d9dc 100644 --- a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c +++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c @@ -639,8 +639,10 @@ static int mmhub_v1_0_ras_late_init(struct amdgpu_device *adev) mmhub_ih_info.head = mmhub_fs_info.head = *adev->gmc.mmhub_ras_if; r = amdgpu_ras_late_init(adev, adev->gmc.mmhub_ras_if, &mmhub_fs_info, &mmhub_ih_info); - if (r || !amdgpu_ras_is_supported(adev, adev->gmc.mmhub_ras_if->block)) + if (r || !amdgpu_ras_is_supported(adev, adev->gmc.mmhub_ras_if->block)) { kfree(adev->gmc.mmhub_ras_if); + adev->gmc.mmhub_ras_if = NULL; + } return r; } diff --git a/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c b/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c index 27eeab143ad7..f25c6a9c6718 100644 --- a/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c +++ b/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c @@ -507,6 +507,9 @@ static int nbio_v7_4_ras_late_init(struct amdgpu_device *adev) r = amdgpu_irq_get(adev, &adev->nbio.ras_err_event_athub_irq, 0); if (r) goto late_fini; + } else { + r = 0; + goto free; } return 0; @@ -514,6 +517,7 @@ late_fini: amdgpu_ras_late_fini(adev, adev->nbio.ras_if, &ih_info); free: kfree(adev->nbio.ras_if); + adev->nbio.ras_if = NULL; return r; } diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c index 4aabb0d9bae5..5e759a877fdf 100644 --- a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c +++ b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c @@ -1728,14 +1728,18 @@ static int sdma_v4_0_late_init(void *handle) if (r) goto late_fini; } - } else - kfree(adev->sdma.ras_if); + } else { + /* free sdma ras_if if sdma ras is not supported */ + r = 0; + goto free; + } return 0; late_fini: amdgpu_ras_late_fini(adev, adev->sdma.ras_if, &ih_info); free: kfree(adev->sdma.ras_if); + adev->sdma.ras_if = NULL; return r; } -- 2.30.2