Skip to content

Commit

Permalink
drm/amdkfd: potential NULL dereference in kfd_set/reset_event()
Browse files Browse the repository at this point in the history
If lookup_event_by_id() returns a NULL "ev" pointer then the
spin_lock(&ev->lock) will crash.  This was detected by Smatch:

    drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_events.c:644 kfd_set_event()
    error: we previously assumed 'ev' could be null (see line 639)

Fixes: 5273e82 ("drm/amdkfd: Improve concurrency of event handling")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
  • Loading branch information
Dan Carpenter authored and Alex Deucher committed Apr 14, 2022
1 parent 46d18d5 commit abb5bc5
Showing 1 changed file with 12 additions and 2 deletions.
14 changes: 12 additions & 2 deletions drivers/gpu/drm/amd/amdkfd/kfd_events.c
Original file line number Diff line number Diff line change
Expand Up @@ -633,14 +633,19 @@ int kfd_set_event(struct kfd_process *p, uint32_t event_id)
rcu_read_lock();

ev = lookup_event_by_id(p, event_id);
if (!ev) {
ret = -EINVAL;
goto unlock_rcu;
}
spin_lock(&ev->lock);

if (ev && event_can_be_cpu_signaled(ev))
if (event_can_be_cpu_signaled(ev))
set_event(ev);
else
ret = -EINVAL;

spin_unlock(&ev->lock);
unlock_rcu:
rcu_read_unlock();
return ret;
}
Expand All @@ -659,14 +664,19 @@ int kfd_reset_event(struct kfd_process *p, uint32_t event_id)
rcu_read_lock();

ev = lookup_event_by_id(p, event_id);
if (!ev) {
ret = -EINVAL;
goto unlock_rcu;
}
spin_lock(&ev->lock);

if (ev && event_can_be_cpu_signaled(ev))
if (event_can_be_cpu_signaled(ev))
reset_event(ev);
else
ret = -EINVAL;

spin_unlock(&ev->lock);
unlock_rcu:
rcu_read_unlock();
return ret;

Expand Down

0 comments on commit abb5bc5

Please sign in to comment.