Commit ea6d8811 authored Oct 07, 2019 by Dan Carpenter Committed by Alex Deucher Oct 07, 2019

drm/amd/powerplay: Fix error handling in smu_init_fb_allocations()



The error handling is off by one.  We should not free the first
"tables[i].bo" without decrementing "i" because that might result in a
double free.  The second problem is that when an error occurs, then the
zeroth element "tables[0].bo" isn't freed.

I had make "i" signed int for the error handling to work, so I just
updated "ret" as well as a clean up.

Fixes: f96357a9 ("drm/amd/powerplay: implement smu_init(fini)_fb_allocations function")
Reviewed-by: Kevin Wang <kevin1.wang@amd.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

parent fa073f13

drivers/gpu/drm/amd/powerplay/amdgpu_smu.c

+2 −3

Original line number	Diff line number	Diff line
		@@ -896,8 +896,7 @@ static int smu_init_fb_allocations(struct smu_context *smu)
		struct amdgpu_device *adev = smu->adev;
		struct smu_table_context *smu_table = &smu->smu_table;
		struct smu_table *tables = smu_table->tables;
		uint32_t i = 0;
		int32_t ret = 0;
		int ret, i;

		for (i = 0; i < SMU_TABLE_COUNT; i++) {
		if (tables[i].size == 0)
		@@ -915,7 +914,7 @@ static int smu_init_fb_allocations(struct smu_context *smu)

		return 0;
		failed:
		for (; i > 0; i--) {
		while (--i >= 0) {
		if (tables[i].size == 0)
		continue;
		amdgpu_bo_free_kernel(&tables[i].bo,

Admin message