* [PATCH] drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj
@ 2022-01-21 5:28 Xin Xiong
2022-01-21 7:45 ` Christian König
0 siblings, 1 reply; 6+ messages in thread
From: Xin Xiong @ 2022-01-21 5:28 UTC (permalink / raw)
To: Alex Deucher, Christian König, Pan, Xinhui, David Airlie,
Daniel Vetter, Sumit Semwal, amd-gfx, dri-devel, linux-kernel,
linux-media, linaro-mm-sig
Cc: Xin Tan, yuanxzhang, Xin Xiong
This issue takes place in an error path in
amdgpu_cs_fence_to_handle_ioctl(). When `info->in.what` falls into
default case, the function simply returns -EINVAL, forgetting to
decrement the reference count of a dma_fence obj, which is bumped
earlier by amdgpu_cs_get_fence(). This may result in reference count
leaks.
Fix it by decreasing the refcount of specific object before returning
the error code.
Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index 0311d799a..894869789 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -1510,6 +1510,7 @@ int amdgpu_cs_fence_to_handle_ioctl(struct drm_device *dev, void *data,
return 0;
default:
+ dma_fence_put(fence);
return -EINVAL;
}
}
--
2.25.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj
2022-01-21 5:28 [PATCH] drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj Xin Xiong
@ 2022-01-21 7:45 ` Christian König
0 siblings, 0 replies; 6+ messages in thread
From: Christian König @ 2022-01-21 7:45 UTC (permalink / raw)
To: Xin Xiong, Alex Deucher, Pan, Xinhui, David Airlie,
Daniel Vetter, Sumit Semwal, amd-gfx, dri-devel, linux-kernel,
linux-media, linaro-mm-sig
Cc: yuanxzhang, Xin Tan
Am 21.01.22 um 06:28 schrieb Xin Xiong:
> This issue takes place in an error path in
> amdgpu_cs_fence_to_handle_ioctl(). When `info->in.what` falls into
> default case, the function simply returns -EINVAL, forgetting to
> decrement the reference count of a dma_fence obj, which is bumped
> earlier by amdgpu_cs_get_fence(). This may result in reference count
> leaks.
>
> Fix it by decreasing the refcount of specific object before returning
> the error code.
>
> Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
> Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Good catch. Reviewed-by: Christian König <christian.koenig@amd.com>
> ---
> drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> index 0311d799a..894869789 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> @@ -1510,6 +1510,7 @@ int amdgpu_cs_fence_to_handle_ioctl(struct drm_device *dev, void *data,
> return 0;
>
> default:
> + dma_fence_put(fence);
> return -EINVAL;
> }
> }
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj
@ 2022-01-21 7:45 ` Christian König
0 siblings, 0 replies; 6+ messages in thread
From: Christian König @ 2022-01-21 7:45 UTC (permalink / raw)
To: Xin Xiong, Alex Deucher, Pan, Xinhui, David Airlie,
Daniel Vetter, Sumit Semwal, amd-gfx, dri-devel, linux-kernel,
linux-media, linaro-mm-sig
Cc: Xin Tan, yuanxzhang
Am 21.01.22 um 06:28 schrieb Xin Xiong:
> This issue takes place in an error path in
> amdgpu_cs_fence_to_handle_ioctl(). When `info->in.what` falls into
> default case, the function simply returns -EINVAL, forgetting to
> decrement the reference count of a dma_fence obj, which is bumped
> earlier by amdgpu_cs_get_fence(). This may result in reference count
> leaks.
>
> Fix it by decreasing the refcount of specific object before returning
> the error code.
>
> Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
> Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Good catch. Reviewed-by: Christian König <christian.koenig@amd.com>
> ---
> drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> index 0311d799a..894869789 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> @@ -1510,6 +1510,7 @@ int amdgpu_cs_fence_to_handle_ioctl(struct drm_device *dev, void *data,
> return 0;
>
> default:
> + dma_fence_put(fence);
> return -EINVAL;
> }
> }
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj
2022-01-21 7:45 ` Christian König
(?)
@ 2022-01-21 20:48 ` Alex Deucher
-1 siblings, 0 replies; 6+ messages in thread
From: Alex Deucher @ 2022-01-21 20:48 UTC (permalink / raw)
To: Christian König
Cc: Xin Xiong, Alex Deucher, Pan, Xinhui, David Airlie,
Daniel Vetter, Sumit Semwal, amd-gfx list,
Maling list - DRI developers, LKML, linux-media,
moderated list:DMA BUFFER SHARING FRAMEWORK, Xin Tan, yuanxzhang
On Fri, Jan 21, 2022 at 2:45 AM Christian König
<christian.koenig@amd.com> wrote:
>
> Am 21.01.22 um 06:28 schrieb Xin Xiong:
> > This issue takes place in an error path in
> > amdgpu_cs_fence_to_handle_ioctl(). When `info->in.what` falls into
> > default case, the function simply returns -EINVAL, forgetting to
> > decrement the reference count of a dma_fence obj, which is bumped
> > earlier by amdgpu_cs_get_fence(). This may result in reference count
> > leaks.
> >
> > Fix it by decreasing the refcount of specific object before returning
> > the error code.
> >
> > Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
> > Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
>
> Good catch. Reviewed-by: Christian König <christian.koenig@amd.com>
Applied manually. Strangely I never got this on any of my emails, and
I don't see it in the archives.
Alex
>
> > ---
> > drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 1 +
> > 1 file changed, 1 insertion(+)
> >
> > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> > index 0311d799a..894869789 100644
> > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> > @@ -1510,6 +1510,7 @@ int amdgpu_cs_fence_to_handle_ioctl(struct drm_device *dev, void *data,
> > return 0;
> >
> > default:
> > + dma_fence_put(fence);
> > return -EINVAL;
> > }
> > }
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj
@ 2022-01-21 20:48 ` Alex Deucher
0 siblings, 0 replies; 6+ messages in thread
From: Alex Deucher @ 2022-01-21 20:48 UTC (permalink / raw)
To: Christian König
Cc: Xin Tan, yuanxzhang, David Airlie, Maling list - DRI developers,
Pan, Xinhui, LKML, Xin Xiong,
moderated list:DMA BUFFER SHARING FRAMEWORK, amd-gfx list,
Alex Deucher, linux-media
On Fri, Jan 21, 2022 at 2:45 AM Christian König
<christian.koenig@amd.com> wrote:
>
> Am 21.01.22 um 06:28 schrieb Xin Xiong:
> > This issue takes place in an error path in
> > amdgpu_cs_fence_to_handle_ioctl(). When `info->in.what` falls into
> > default case, the function simply returns -EINVAL, forgetting to
> > decrement the reference count of a dma_fence obj, which is bumped
> > earlier by amdgpu_cs_get_fence(). This may result in reference count
> > leaks.
> >
> > Fix it by decreasing the refcount of specific object before returning
> > the error code.
> >
> > Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
> > Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
>
> Good catch. Reviewed-by: Christian König <christian.koenig@amd.com>
Applied manually. Strangely I never got this on any of my emails, and
I don't see it in the archives.
Alex
>
> > ---
> > drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 1 +
> > 1 file changed, 1 insertion(+)
> >
> > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> > index 0311d799a..894869789 100644
> > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> > @@ -1510,6 +1510,7 @@ int amdgpu_cs_fence_to_handle_ioctl(struct drm_device *dev, void *data,
> > return 0;
> >
> > default:
> > + dma_fence_put(fence);
> > return -EINVAL;
> > }
> > }
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj
@ 2022-01-21 20:48 ` Alex Deucher
0 siblings, 0 replies; 6+ messages in thread
From: Alex Deucher @ 2022-01-21 20:48 UTC (permalink / raw)
To: Christian König
Cc: Xin Tan, yuanxzhang, David Airlie, Maling list - DRI developers,
Pan, Xinhui, LKML, Xin Xiong,
moderated list:DMA BUFFER SHARING FRAMEWORK, amd-gfx list,
Daniel Vetter, Alex Deucher, Sumit Semwal, linux-media
On Fri, Jan 21, 2022 at 2:45 AM Christian König
<christian.koenig@amd.com> wrote:
>
> Am 21.01.22 um 06:28 schrieb Xin Xiong:
> > This issue takes place in an error path in
> > amdgpu_cs_fence_to_handle_ioctl(). When `info->in.what` falls into
> > default case, the function simply returns -EINVAL, forgetting to
> > decrement the reference count of a dma_fence obj, which is bumped
> > earlier by amdgpu_cs_get_fence(). This may result in reference count
> > leaks.
> >
> > Fix it by decreasing the refcount of specific object before returning
> > the error code.
> >
> > Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
> > Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
>
> Good catch. Reviewed-by: Christian König <christian.koenig@amd.com>
Applied manually. Strangely I never got this on any of my emails, and
I don't see it in the archives.
Alex
>
> > ---
> > drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 1 +
> > 1 file changed, 1 insertion(+)
> >
> > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> > index 0311d799a..894869789 100644
> > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> > @@ -1510,6 +1510,7 @@ int amdgpu_cs_fence_to_handle_ioctl(struct drm_device *dev, void *data,
> > return 0;
> >
> > default:
> > + dma_fence_put(fence);
> > return -EINVAL;
> > }
> > }
>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2022-01-21 20:48 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-01-21 5:28 [PATCH] drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj Xin Xiong
2022-01-21 7:45 ` Christian König
2022-01-21 7:45 ` Christian König
2022-01-21 20:48 ` Alex Deucher
2022-01-21 20:48 ` Alex Deucher
2022-01-21 20:48 ` Alex Deucher
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.