* Re: [PATCH] drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj
[not found] <20220121052827.4384-1-xiongx18@fudan.edu.cn>
@ 2022-01-21 7:45 ` Christian König
2022-01-21 20:48 ` Alex Deucher
0 siblings, 1 reply; 2+ messages in thread
From: Christian König @ 2022-01-21 7:45 UTC (permalink / raw)
To: Xin Xiong, Alex Deucher, Pan, Xinhui, David Airlie,
Daniel Vetter, Sumit Semwal, amd-gfx, dri-devel, linux-kernel,
linux-media, linaro-mm-sig
Cc: yuanxzhang, Xin Tan
Am 21.01.22 um 06:28 schrieb Xin Xiong:
> This issue takes place in an error path in
> amdgpu_cs_fence_to_handle_ioctl(). When `info->in.what` falls into
> default case, the function simply returns -EINVAL, forgetting to
> decrement the reference count of a dma_fence obj, which is bumped
> earlier by amdgpu_cs_get_fence(). This may result in reference count
> leaks.
>
> Fix it by decreasing the refcount of specific object before returning
> the error code.
>
> Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
> Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Good catch. Reviewed-by: Christian König <christian.koenig@amd.com>
> ---
> drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> index 0311d799a..894869789 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> @@ -1510,6 +1510,7 @@ int amdgpu_cs_fence_to_handle_ioctl(struct drm_device *dev, void *data,
> return 0;
>
> default:
> + dma_fence_put(fence);
> return -EINVAL;
> }
> }
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj
2022-01-21 7:45 ` [PATCH] drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj Christian König
@ 2022-01-21 20:48 ` Alex Deucher
0 siblings, 0 replies; 2+ messages in thread
From: Alex Deucher @ 2022-01-21 20:48 UTC (permalink / raw)
To: Christian König
Cc: Xin Xiong, Alex Deucher, Pan, Xinhui, David Airlie,
Daniel Vetter, Sumit Semwal, amd-gfx list,
Maling list - DRI developers, LKML, linux-media,
moderated list:DMA BUFFER SHARING FRAMEWORK, Xin Tan, yuanxzhang
On Fri, Jan 21, 2022 at 2:45 AM Christian König
<christian.koenig@amd.com> wrote:
>
> Am 21.01.22 um 06:28 schrieb Xin Xiong:
> > This issue takes place in an error path in
> > amdgpu_cs_fence_to_handle_ioctl(). When `info->in.what` falls into
> > default case, the function simply returns -EINVAL, forgetting to
> > decrement the reference count of a dma_fence obj, which is bumped
> > earlier by amdgpu_cs_get_fence(). This may result in reference count
> > leaks.
> >
> > Fix it by decreasing the refcount of specific object before returning
> > the error code.
> >
> > Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
> > Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
>
> Good catch. Reviewed-by: Christian König <christian.koenig@amd.com>
Applied manually. Strangely I never got this on any of my emails, and
I don't see it in the archives.
Alex
>
> > ---
> > drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 1 +
> > 1 file changed, 1 insertion(+)
> >
> > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> > index 0311d799a..894869789 100644
> > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> > @@ -1510,6 +1510,7 @@ int amdgpu_cs_fence_to_handle_ioctl(struct drm_device *dev, void *data,
> > return 0;
> >
> > default:
> > + dma_fence_put(fence);
> > return -EINVAL;
> > }
> > }
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-01-21 20:48 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <20220121052827.4384-1-xiongx18@fudan.edu.cn>
2022-01-21 7:45 ` [PATCH] drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj Christian König
2022-01-21 20:48 ` Alex Deucher
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).