drm/amdgpu: don't leave dangling pointers around (54ddf3a6) · Commits · 戴 / test

Right now it's possible to trigger fence_drv.fences[] dereference after the array has been freed. While the real problem is elsewhere, this still results in confusing errors that depend on how the freed memory was reused (I've seen "kernel tried to execute NX-protected page"), it's better to clear them and get NULL dereference so that it's obvious what's going wrong. Signed-off-by:

Grazvydas Ignotas <notasas@gmail.com> Signed-off-by:

Alex Deucher <alexander.deucher@amd.com>

drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -60,6 +60,7 @@ static int amdgpu_ctx_init(struct amdgpu_device adev, struct amdgpu_ctx ctx)
		amd_sched_entity_fini(&adev->rings[j]->sched,
		&ctx->rings[j].entity);
		kfree(ctx->fences);
		ctx->fences = NULL;
		return r;
		}
		return 0;
		@@ -77,6 +78,7 @@ static void amdgpu_ctx_fini(struct amdgpu_ctx *ctx)
		for (j = 0; j < amdgpu_sched_jobs; ++j)
		fence_put(ctx->rings[i].fences[j]);
		kfree(ctx->fences);
		ctx->fences = NULL;

		for (i = 0; i < adev->num_rings; i++)
		amd_sched_entity_fini(&adev->rings[i]->sched,

drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -454,6 +454,7 @@ void amdgpu_fence_driver_fini(struct amdgpu_device *adev)
		for (j = 0; j <= ring->fence_drv.num_fences_mask; ++j)
		fence_put(ring->fence_drv.fences[j]);
		kfree(ring->fence_drv.fences);
		ring->fence_drv.fences = NULL;
		ring->fence_drv.initialized = false;
		}
		}

Admin message