All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] drm/amdkfd: potential NULL dereference in kfd_set/reset_event()
@ 2022-04-13  7:36 ` Dan Carpenter
  0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2022-04-13  7:36 UTC (permalink / raw)
  To: Felix Kuehling
  Cc: Alex Deucher, Christian König, Pan, Xinhui, David Airlie,
	Daniel Vetter, Sean Keely, amd-gfx, kernel-janitors

If lookup_event_by_id() returns a NULL "ev" pointer then the
spin_lock(&ev->lock) will crash.  This was detected by Smatch:

    drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_events.c:644 kfd_set_event()
    error: we previously assumed 'ev' could be null (see line 639)

Fixes: 5273e82c5f47 ("drm/amdkfd: Improve concurrency of event handling")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/gpu/drm/amd/amdkfd/kfd_events.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
index 0fef24b0b915..15570e72a5dd 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
@@ -634,14 +634,19 @@ int kfd_set_event(struct kfd_process *p, uint32_t event_id)
 	rcu_read_lock();
 
 	ev = lookup_event_by_id(p, event_id);
+	if (!ev) {
+		ret = -EINVAL;
+		goto unlock_rcu;
+	}
 	spin_lock(&ev->lock);
 
-	if (ev && event_can_be_cpu_signaled(ev))
+	if (event_can_be_cpu_signaled(ev))
 		set_event(ev);
 	else
 		ret = -EINVAL;
 
 	spin_unlock(&ev->lock);
+unlock_rcu:
 	rcu_read_unlock();
 	return ret;
 }
@@ -660,14 +665,19 @@ int kfd_reset_event(struct kfd_process *p, uint32_t event_id)
 	rcu_read_lock();
 
 	ev = lookup_event_by_id(p, event_id);
+	if (!ev) {
+		ret = -EINVAL;
+		goto unlock_rcu;
+	}
 	spin_lock(&ev->lock);
 
-	if (ev && event_can_be_cpu_signaled(ev))
+	if (event_can_be_cpu_signaled(ev))
 		reset_event(ev);
 	else
 		ret = -EINVAL;
 
 	spin_unlock(&ev->lock);
+unlock_rcu:
 	rcu_read_unlock();
 	return ret;
 
-- 
2.20.1


^ permalink raw reply related	[flat|nested] 4+ messages in thread
* [PATCH] drm/amdkfd: potential NULL dereference in kfd_set/reset_event()
@ 2022-04-13  7:36 ` Dan Carpenter
  0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2022-04-13  7:36 UTC (permalink / raw)
  To: Felix Kuehling
  Cc: David Airlie, Pan, Xinhui, kernel-janitors, amd-gfx,
	Daniel Vetter, Alex Deucher, Sean Keely, Christian König

If lookup_event_by_id() returns a NULL "ev" pointer then the
spin_lock(&ev->lock) will crash.  This was detected by Smatch:

    drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_events.c:644 kfd_set_event()
    error: we previously assumed 'ev' could be null (see line 639)

Fixes: 5273e82c5f47 ("drm/amdkfd: Improve concurrency of event handling")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/gpu/drm/amd/amdkfd/kfd_events.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
index 0fef24b0b915..15570e72a5dd 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
@@ -634,14 +634,19 @@ int kfd_set_event(struct kfd_process *p, uint32_t event_id)
 	rcu_read_lock();
 
 	ev = lookup_event_by_id(p, event_id);
+	if (!ev) {
+		ret = -EINVAL;
+		goto unlock_rcu;
+	}
 	spin_lock(&ev->lock);
 
-	if (ev && event_can_be_cpu_signaled(ev))
+	if (event_can_be_cpu_signaled(ev))
 		set_event(ev);
 	else
 		ret = -EINVAL;
 
 	spin_unlock(&ev->lock);
+unlock_rcu:
 	rcu_read_unlock();
 	return ret;
 }
@@ -660,14 +665,19 @@ int kfd_reset_event(struct kfd_process *p, uint32_t event_id)
 	rcu_read_lock();
 
 	ev = lookup_event_by_id(p, event_id);
+	if (!ev) {
+		ret = -EINVAL;
+		goto unlock_rcu;
+	}
 	spin_lock(&ev->lock);
 
-	if (ev && event_can_be_cpu_signaled(ev))
+	if (event_can_be_cpu_signaled(ev))
 		reset_event(ev);
 	else
 		ret = -EINVAL;
 
 	spin_unlock(&ev->lock);
+unlock_rcu:
 	rcu_read_unlock();
 	return ret;
 
-- 
2.20.1


^ permalink raw reply related	[flat|nested] 4+ messages in thread
* Re: [PATCH] drm/amdkfd: potential NULL dereference in kfd_set/reset_event()
  2022-04-13  7:36 ` Dan Carpenter
@ 2022-04-13 14:49   ` Felix Kuehling
  -1 siblings, 0 replies; 4+ messages in thread
From: Felix Kuehling @ 2022-04-13 14:49 UTC (permalink / raw)
  To: Dan Carpenter
  Cc: Alex Deucher, Christian König, Pan, Xinhui, David Airlie,
	Daniel Vetter, Sean Keely, amd-gfx, kernel-janitors


Am 2022-04-13 um 03:36 schrieb Dan Carpenter:
> If lookup_event_by_id() returns a NULL "ev" pointer then the
> spin_lock(&ev->lock) will crash.  This was detected by Smatch:
>
>      drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_events.c:644 kfd_set_event()
>      error: we previously assumed 'ev' could be null (see line 639)
>
> Fixes: 5273e82c5f47 ("drm/amdkfd: Improve concurrency of event handling")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

The patch is

Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>

I will apply it to amd-staging-drm-next. Thank you!


> ---
>   drivers/gpu/drm/amd/amdkfd/kfd_events.c | 14 ++++++++++++--
>   1 file changed, 12 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
> index 0fef24b0b915..15570e72a5dd 100644
> --- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c
> +++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
> @@ -634,14 +634,19 @@ int kfd_set_event(struct kfd_process *p, uint32_t event_id)
>   	rcu_read_lock();
>   
>   	ev = lookup_event_by_id(p, event_id);
> +	if (!ev) {
> +		ret = -EINVAL;
> +		goto unlock_rcu;
> +	}
>   	spin_lock(&ev->lock);
>   
> -	if (ev && event_can_be_cpu_signaled(ev))
> +	if (event_can_be_cpu_signaled(ev))
>   		set_event(ev);
>   	else
>   		ret = -EINVAL;
>   
>   	spin_unlock(&ev->lock);
> +unlock_rcu:
>   	rcu_read_unlock();
>   	return ret;
>   }
> @@ -660,14 +665,19 @@ int kfd_reset_event(struct kfd_process *p, uint32_t event_id)
>   	rcu_read_lock();
>   
>   	ev = lookup_event_by_id(p, event_id);
> +	if (!ev) {
> +		ret = -EINVAL;
> +		goto unlock_rcu;
> +	}
>   	spin_lock(&ev->lock);
>   
> -	if (ev && event_can_be_cpu_signaled(ev))
> +	if (event_can_be_cpu_signaled(ev))
>   		reset_event(ev);
>   	else
>   		ret = -EINVAL;
>   
>   	spin_unlock(&ev->lock);
> +unlock_rcu:
>   	rcu_read_unlock();
>   	return ret;
>   

^ permalink raw reply	[flat|nested] 4+ messages in thread
* Re: [PATCH] drm/amdkfd: potential NULL dereference in kfd_set/reset_event()
@ 2022-04-13 14:49   ` Felix Kuehling
  0 siblings, 0 replies; 4+ messages in thread
From: Felix Kuehling @ 2022-04-13 14:49 UTC (permalink / raw)
  To: Dan Carpenter
  Cc: David Airlie, Pan, Xinhui, kernel-janitors, amd-gfx,
	Daniel Vetter, Alex Deucher, Sean Keely, Christian König


Am 2022-04-13 um 03:36 schrieb Dan Carpenter:
> If lookup_event_by_id() returns a NULL "ev" pointer then the
> spin_lock(&ev->lock) will crash.  This was detected by Smatch:
>
>      drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_events.c:644 kfd_set_event()
>      error: we previously assumed 'ev' could be null (see line 639)
>
> Fixes: 5273e82c5f47 ("drm/amdkfd: Improve concurrency of event handling")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

The patch is

Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>

I will apply it to amd-staging-drm-next. Thank you!


> ---
>   drivers/gpu/drm/amd/amdkfd/kfd_events.c | 14 ++++++++++++--
>   1 file changed, 12 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
> index 0fef24b0b915..15570e72a5dd 100644
> --- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c
> +++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
> @@ -634,14 +634,19 @@ int kfd_set_event(struct kfd_process *p, uint32_t event_id)
>   	rcu_read_lock();
>   
>   	ev = lookup_event_by_id(p, event_id);
> +	if (!ev) {
> +		ret = -EINVAL;
> +		goto unlock_rcu;
> +	}
>   	spin_lock(&ev->lock);
>   
> -	if (ev && event_can_be_cpu_signaled(ev))
> +	if (event_can_be_cpu_signaled(ev))
>   		set_event(ev);
>   	else
>   		ret = -EINVAL;
>   
>   	spin_unlock(&ev->lock);
> +unlock_rcu:
>   	rcu_read_unlock();
>   	return ret;
>   }
> @@ -660,14 +665,19 @@ int kfd_reset_event(struct kfd_process *p, uint32_t event_id)
>   	rcu_read_lock();
>   
>   	ev = lookup_event_by_id(p, event_id);
> +	if (!ev) {
> +		ret = -EINVAL;
> +		goto unlock_rcu;
> +	}
>   	spin_lock(&ev->lock);
>   
> -	if (ev && event_can_be_cpu_signaled(ev))
> +	if (event_can_be_cpu_signaled(ev))
>   		reset_event(ev);
>   	else
>   		ret = -EINVAL;
>   
>   	spin_unlock(&ev->lock);
> +unlock_rcu:
>   	rcu_read_unlock();
>   	return ret;
>   

^ permalink raw reply	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-04-13 14:49 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-04-13  7:36 [PATCH] drm/amdkfd: potential NULL dereference in kfd_set/reset_event() Dan Carpenter
2022-04-13  7:36 ` Dan Carpenter
2022-04-13 14:49 ` Felix Kuehling
2022-04-13 14:49   ` Felix Kuehling

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.