[PATCH] drm/amdgpu: fix error handling in amdgpu_cs_user_fence_chunk

[PATCH] drm/amdgpu: fix error handling in amdgpu_cs_user_fence_chunk

[Christian König]

Slowly leaking memory one page at a time :)

Signed-off-by: Christian König <christian.koenig@amd.com>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index 04a2733b5ccc..7d6a88602d4f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -40,6 +40,7 @@ static int amdgpu_cs_user_fence_chunk(struct amdgpu_cs_parser *p,
 {
 	struct drm_gem_object *gobj;
 	unsigned long size;
+	int r;
 
 	gobj = drm_gem_object_lookup(p->filp, data->handle);
 	if (gobj == NULL)
@@ -51,20 +52,26 @@ static int amdgpu_cs_user_fence_chunk(struct amdgpu_cs_parser *p,
 	p->uf_entry.tv.shared = true;
 	p->uf_entry.user_pages = NULL;
 
-	size = amdgpu_bo_size(p->uf_entry.robj);
-	if (size != PAGE_SIZE || (data->offset + 8) > size)
-		return -EINVAL;
-
-	*offset = data->offset;
-
 	drm_gem_object_put_unlocked(gobj);
 
+	size = amdgpu_bo_size(p->uf_entry.robj);
+	if (size != PAGE_SIZE || (data->offset + 8) > size) {
+		r = -EINVAL;
+		goto error_unref;
+	}
+
 	if (amdgpu_ttm_tt_get_usermm(p->uf_entry.robj->tbo.ttm)) {
-		amdgpu_bo_unref(&p->uf_entry.robj);
-		return -EINVAL;
+		r = -EINVAL;
+		goto error_unref;
 	}
 
+	*offset = data->offset;
+
 	return 0;
+
+error_unref:
+	amdgpu_bo_unref(&p->uf_entry.robj);
+	return r;
 }
 
 static int amdgpu_cs_bo_handles_chunk(struct amdgpu_cs_parser *p,
-- 
2.14.1

_______________________________________________
amd-gfx mailing list
amd-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/amd-gfx

Re: [PATCH] drm/amdgpu: fix error handling in amdgpu_cs_user_fence_chunk

[Andrey Grodzovsky]

Reviewed-by: Andrey Grodzovsky <andrey.grodzovsky@amd.com>

Andrey

On 09/10/2018 09:54 AM, Christian König wrote:
> Slowly leaking memory one page at a time :)
>
> Signed-off-by: Christian König <christian.koenig@amd.com>
> ---
>   drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 23 +++++++++++++++--------
>   1 file changed, 15 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> index 04a2733b5ccc..7d6a88602d4f 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> @@ -40,6 +40,7 @@ static int amdgpu_cs_user_fence_chunk(struct amdgpu_cs_parser *p,
>   {
>   	struct drm_gem_object *gobj;
>   	unsigned long size;
> +	int r;
>   
>   	gobj = drm_gem_object_lookup(p->filp, data->handle);
>   	if (gobj == NULL)
> @@ -51,20 +52,26 @@ static int amdgpu_cs_user_fence_chunk(struct amdgpu_cs_parser *p,
>   	p->uf_entry.tv.shared = true;
>   	p->uf_entry.user_pages = NULL;
>   
> -	size = amdgpu_bo_size(p->uf_entry.robj);
> -	if (size != PAGE_SIZE || (data->offset + 8) > size)
> -		return -EINVAL;
> -
> -	*offset = data->offset;
> -
>   	drm_gem_object_put_unlocked(gobj);
>   
> +	size = amdgpu_bo_size(p->uf_entry.robj);
> +	if (size != PAGE_SIZE || (data->offset + 8) > size) {
> +		r = -EINVAL;
> +		goto error_unref;
> +	}
> +
>   	if (amdgpu_ttm_tt_get_usermm(p->uf_entry.robj->tbo.ttm)) {
> -		amdgpu_bo_unref(&p->uf_entry.robj);
> -		return -EINVAL;
> +		r = -EINVAL;
> +		goto error_unref;
>   	}
>   
> +	*offset = data->offset;
> +
>   	return 0;
> +
> +error_unref:
> +	amdgpu_bo_unref(&p->uf_entry.robj);
> +	return r;
>   }
>   
>   static int amdgpu_cs_bo_handles_chunk(struct amdgpu_cs_parser *p,

_______________________________________________
amd-gfx mailing list
amd-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/amd-gfx