diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2022-04-13 10:36:40 +0300 |
|---|---|---|
| committer | Alex Deucher <alexander.deucher@amd.com> | 2022-04-14 15:24:22 -0400 |
| commit | abb5bc59490067b88ed006cdb58f3ff1d12057cc (patch) | |
| tree | 253ca9eaca167521e89038f544d0b74ce12bd13e | |
| parent | 46d18d510d78318c4aa5aaeff66782f1ec42c2ec (diff) | |
drm/amdkfd: potential NULL dereference in kfd_set/reset_event()
If lookup_event_by_id() returns a NULL "ev" pointer then the
spin_lock(&ev->lock) will crash. This was detected by Smatch:
drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_events.c:644 kfd_set_event()
error: we previously assumed 'ev' could be null (see line 639)
Fixes: 5273e82c5f47 ("drm/amdkfd: Improve concurrency of event handling")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
| -rw-r--r-- | drivers/gpu/drm/amd/amdkfd/kfd_events.c | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_events.c index 75847c5d5957..e449bc70bf08 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c @@ -633,14 +633,19 @@ int kfd_set_event(struct kfd_process *p, uint32_t event_id) rcu_read_lock(); ev = lookup_event_by_id(p, event_id); + if (!ev) { + ret = -EINVAL; + goto unlock_rcu; + } spin_lock(&ev->lock); - if (ev && event_can_be_cpu_signaled(ev)) + if (event_can_be_cpu_signaled(ev)) set_event(ev); else ret = -EINVAL; spin_unlock(&ev->lock); +unlock_rcu: rcu_read_unlock(); return ret; } @@ -659,14 +664,19 @@ int kfd_reset_event(struct kfd_process *p, uint32_t event_id) rcu_read_lock(); ev = lookup_event_by_id(p, event_id); + if (!ev) { + ret = -EINVAL; + goto unlock_rcu; + } spin_lock(&ev->lock); - if (ev && event_can_be_cpu_signaled(ev)) + if (event_can_be_cpu_signaled(ev)) reset_event(ev); else ret = -EINVAL; spin_unlock(&ev->lock); +unlock_rcu: rcu_read_unlock(); return ret; |