drm/amdgpu: prevent memory leaks in AMDGPU_CS ioctl (1a701ea9) · Commits · 戴 / test

Error out if the AMDGPU_CS ioctl is called with multiple SYNCOBJ_OUT and/or TIMELINE_SIGNAL chunks, since otherwise the last chunk wins while the allocated array as well as the reference counts of sync objects are leaked. Signed-off-by:

Nicolai Hähnle <nicolai.haehnle@amd.com> Reviewed-by:

Christian König <christian.koenig@amd.com> Signed-off-by:

Alex Deucher <alexander.deucher@amd.com>

drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c

+7 −2

Original line number	Diff line number	Diff line
		@@ -1143,6 +1143,9 @@ static int amdgpu_cs_process_syncobj_out_dep(struct amdgpu_cs_parser *p,
		num_deps = chunk->length_dw * 4 /
		sizeof(struct drm_amdgpu_cs_chunk_sem);

		if (p->post_deps)
		return -EINVAL;

		p->post_deps = kmalloc_array(num_deps, sizeof(*p->post_deps),
		GFP_KERNEL);
		p->num_post_deps = 0;
		@@ -1166,8 +1169,7 @@ static int amdgpu_cs_process_syncobj_out_dep(struct amdgpu_cs_parser *p,


		static int amdgpu_cs_process_syncobj_timeline_out_dep(struct amdgpu_cs_parser *p,
		struct amdgpu_cs_chunk
		*chunk)
		struct amdgpu_cs_chunk *chunk)
		{
		struct drm_amdgpu_cs_chunk_syncobj *syncobj_deps;
		unsigned num_deps;
		@@ -1177,6 +1179,9 @@ static int amdgpu_cs_process_syncobj_timeline_out_dep(struct amdgpu_cs_parser *p
		num_deps = chunk->length_dw * 4 /
		sizeof(struct drm_amdgpu_cs_chunk_syncobj);

		if (p->post_deps)
		return -EINVAL;

		p->post_deps = kmalloc_array(num_deps, sizeof(*p->post_deps),
		GFP_KERNEL);
		p->num_post_deps = 0;

Admin message