[PATCH 1/3] amdgpu: Unlock mutex if base_required is invalid

[PATCH 1/3] amdgpu: Unlock mutex if base_required is invalid

[Alex Deucher]

From: Tom St Denis <tom.stdenis@amd.com>

In the function amdgpu_vamgr_find_va() the function would return
without unlocking the mutex if the base_required offset was below
the va managers base offset.

Signed-off-by: Tom St Denis <tom.stdenis@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
---
 amdgpu/amdgpu_vamgr.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/amdgpu/amdgpu_vamgr.c b/amdgpu/amdgpu_vamgr.c
index 04d2881..2221da0 100644
--- a/amdgpu/amdgpu_vamgr.c
+++ b/amdgpu/amdgpu_vamgr.c
@@ -124,8 +124,10 @@ amdgpu_vamgr_find_va(struct amdgpu_bo_va_mgr *mgr, uint64_t size,
 	}
 
 	if (base_required) {
-		if (base_required < mgr->va_offset)
+		if (base_required < mgr->va_offset) {
+			pthread_mutex_unlock(&mgr->bo_va_mutex);
 			return AMDGPU_INVALID_VA_ADDRESS;
+		}
 		offset = mgr->va_offset;
 		waste = base_required - mgr->va_offset;
 	} else {
-- 
1.8.3.1

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/dri-devel

[PATCH 2/3] amdgpu: Fix use-after-free bug in vamgr_deinit

[Alex Deucher]

From: Tom St Denis <tom.stdenis@amd.com>

This patch fixes a use-after-free bug in the vamgr_deinit function.

Signed-off-by: Tom St Denis <tom.stdenis@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
---
 amdgpu/amdgpu_vamgr.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/amdgpu/amdgpu_vamgr.c b/amdgpu/amdgpu_vamgr.c
index 2221da0..8a707cb 100644
--- a/amdgpu/amdgpu_vamgr.c
+++ b/amdgpu/amdgpu_vamgr.c
@@ -57,8 +57,8 @@ drm_private void amdgpu_vamgr_init(struct amdgpu_bo_va_mgr *mgr, uint64_t start,
 
 drm_private void amdgpu_vamgr_deinit(struct amdgpu_bo_va_mgr *mgr)
 {
-	struct amdgpu_bo_va_hole *hole;
-	LIST_FOR_EACH_ENTRY(hole, &mgr->va_holes, list) {
+	struct amdgpu_bo_va_hole *hole, *tmp;
+	LIST_FOR_EACH_ENTRY_SAFE(hole, tmp, &mgr->va_holes, list) {
 		list_del(&hole->list);
 		free(hole);
 	}
-- 
1.8.3.1

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/dri-devel

[PATCH 3/3] amdgpu: Cleanly handle ENOMEM on result in amdgpu_bo_list_create()

[Alex Deucher]

From: Tom St Denis <tom.stdenis@amd.com>

Move the allocation of result prior to the IOCTL so we can cleanly
backtrack if the allocation fails.

Signed-off-by: Tom St Denis <tom.stdenis@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
---
 amdgpu/amdgpu_bo.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/amdgpu/amdgpu_bo.c b/amdgpu/amdgpu_bo.c
index 348da00..1a5a401 100644
--- a/amdgpu/amdgpu_bo.c
+++ b/amdgpu/amdgpu_bo.c
@@ -591,6 +591,12 @@ int amdgpu_bo_list_create(amdgpu_device_handle dev,
 	if (!list)
 		return -ENOMEM;
 
+	*result = malloc(sizeof(struct amdgpu_bo_list));
+	if (!*result) {
+		free(list);
+		return -ENOMEM;
+	}
+
 	memset(&args, 0, sizeof(args));
 	args.in.operation = AMDGPU_BO_LIST_OP_CREATE;
 	args.in.bo_number = number_of_resources;
@@ -608,10 +614,11 @@ int amdgpu_bo_list_create(amdgpu_device_handle dev,
 	r = drmCommandWriteRead(dev->fd, DRM_AMDGPU_BO_LIST,
 				&args, sizeof(args));
 	free(list);
-	if (r)
+	if (r) {
+		free(*result);
 		return r;
+	}
 
-	*result = malloc(sizeof(struct amdgpu_bo_list));
 	(*result)->dev = dev;
 	(*result)->handle = args.out.list_handle;
 	return 0;
-- 
1.8.3.1

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/dri-devel