From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Philip Yang <Philip.Yang@amd.com>,
Felix Kuehling <Felix.Kuehling@amd.com>,
Alex Deucher <alexander.deucher@amd.com>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.15 36/42] drm/amdkfd: fix double free mem structure
Date: Wed, 15 Dec 2021 18:21:17 +0100 [thread overview]
Message-ID: <20211215172027.886545805@linuxfoundation.org> (raw)
In-Reply-To: <20211215172026.641863587@linuxfoundation.org>
From: Philip Yang <Philip.Yang@amd.com>
[ Upstream commit 494f2e42ce4a9ddffb5d8c5b2db816425ef90397 ]
drm_gem_object_put calls release_notify callback to free the mem
structure and unreserve_mem_limit, move it down after the last access
of mem and make it conditional call.
Signed-off-by: Philip Yang <Philip.Yang@amd.com>
Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
index cdf46bd0d8d5b..ab36cce59d2e4 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
@@ -1393,7 +1393,7 @@ int amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu(
struct sg_table *sg = NULL;
uint64_t user_addr = 0;
struct amdgpu_bo *bo;
- struct drm_gem_object *gobj;
+ struct drm_gem_object *gobj = NULL;
u32 domain, alloc_domain;
u64 alloc_flags;
int ret;
@@ -1503,14 +1503,16 @@ int amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu(
remove_kgd_mem_from_kfd_bo_list(*mem, avm->process_info);
drm_vma_node_revoke(&gobj->vma_node, drm_priv);
err_node_allow:
- drm_gem_object_put(gobj);
/* Don't unreserve system mem limit twice */
goto err_reserve_limit;
err_bo_create:
unreserve_mem_limit(adev, size, alloc_domain, !!sg);
err_reserve_limit:
mutex_destroy(&(*mem)->lock);
- kfree(*mem);
+ if (gobj)
+ drm_gem_object_put(gobj);
+ else
+ kfree(*mem);
err:
if (sg) {
sg_free_table(sg);
--
2.33.0
next prev parent reply other threads:[~2021-12-15 17:24 UTC|newest]
Thread overview: 52+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-15 17:20 [PATCH 5.15 00/42] 5.15.9-rc1 review Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 01/42] nfc: fix segfault in nfc_genl_dump_devices_done Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 02/42] hwmon: (corsair-psu) fix plain integer used as NULL pointer Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 03/42] RDMA: Fix use-after-free in rxe_queue_cleanup Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 04/42] RDMA/mlx5: Fix releasing unallocated memory in dereg MR flow Greg Kroah-Hartman
2022-01-01 10:56 ` Thorsten Leemhuis
2022-01-07 5:57 ` Thorsten Leemhuis
2022-01-07 10:57 ` Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 05/42] mtd: rawnand: Fix nand_erase_op delay Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 06/42] mtd: rawnand: Fix nand_choose_best_timings() on unsupported interface Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 07/42] inet: use #ifdef CONFIG_SOCK_RX_QUEUE_MAPPING consistently Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 08/42] dt-bindings: media: nxp,imx7-mipi-csi2: Drop bad if/then schema Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 09/42] clk: qcom: sm6125-gcc: Swap ops of ice and apps on sdcc1 Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 10/42] perf bpf_skel: Do not use typedef to avoid error on old clang Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 11/42] netfs: Fix lockdep warning from taking sb_writers whilst holding mmap_lock Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 12/42] RDMA/irdma: Fix a user-after-free in add_pble_prm Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 13/42] RDMA/irdma: Fix a potential memory allocation issue in irdma_prm_add_pble_mem() Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 14/42] RDMA/irdma: Report correct WC errors Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 15/42] RDMA/irdma: Dont arm the CQ more than two times if no CE for this CQ Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 16/42] ice: fix FDIR init missing when reset VF Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 17/42] vmxnet3: fix minimum vectors alloc issue Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 18/42] i2c: virtio: fix completion handling Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 19/42] drm/msm: Fix null ptr access msm_ioctl_gem_submit() Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 20/42] drm/msm/a6xx: Fix uinitialized use of gpu_scid Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 21/42] drm/msm/dsi: set default num_data_lanes Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 22/42] drm/msm/dp: Avoid unpowered AUX xfers that caused crashes Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 23/42] KVM: arm64: Save PSTATE early on exit Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 24/42] s390/test_unwind: use raw opcode instead of invalid instruction Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 25/42] Revert "tty: serial: fsl_lpuart: drop earlycon entry for i.MX8QXP" Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 26/42] net/mlx4_en: Update reported link modes for 1/10G Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 27/42] loop: Use pr_warn_once() for loop_control_remove() warning Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 28/42] ALSA: hda: Add Intel DG2 PCI ID and HDMI codec vid Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 29/42] ALSA: hda/hdmi: fix HDA codec entry table order for ADL-P Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 30/42] parisc/agp: Annotate parisc agp init functions with __init Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 31/42] i2c: rk3x: Handle a spurious start completion interrupt flag Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 32/42] net: netlink: af_netlink: Prevent empty skb by adding a check on len Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 33/42] drm/amdgpu: cancel the correct hrtimer on exit Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 34/42] drm/amdgpu: check atomic flag to differeniate with legacy path Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 35/42] drm/amd/display: Fix for the no Audio bug with Tiled Displays Greg Kroah-Hartman
2021-12-15 17:21 ` Greg Kroah-Hartman [this message]
2021-12-15 17:21 ` [PATCH 5.15 37/42] drm/amd/display: add connector type check for CRC source set Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 38/42] drm/amdkfd: process_info lock not needed for svm Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 39/42] tracing: Fix a kmemleak false positive in tracing_map Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 40/42] staging: most: dim2: use device release method Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 41/42] fuse: make sure reclaim doesnt write the inode Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 42/42] perf inject: Fix itrace space allowed for new attributes Greg Kroah-Hartman
2021-12-15 20:01 ` [PATCH 5.15 00/42] 5.15.9-rc1 review Jon Hunter
2021-12-15 21:51 ` Shuah Khan
2021-12-15 23:03 ` Fox Chen
2021-12-15 23:46 ` Florian Fainelli
2021-12-16 3:08 ` Naresh Kamboju
2021-12-16 18:08 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211215172027.886545805@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=Felix.Kuehling@amd.com \
--cc=Philip.Yang@amd.com \
--cc=alexander.deucher@amd.com \
--cc=linux-kernel@vger.kernel.org \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).