Commit abb5bc59 authored by Dan Carpenter's avatar Dan Carpenter Committed by Alex Deucher

drm/amdkfd: potential NULL dereference in kfd_set/reset_event()

If lookup_event_by_id() returns a NULL "ev" pointer then the
spin_lock(&ev->lock) will crash.  This was detected by Smatch:

    drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_events.c:644 kfd_set_event()
    error: we previously assumed 'ev' could be null (see line 639)

Fixes: 5273e82c ("drm/amdkfd: Improve concurrency of event handling")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: default avatarFelix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: default avatarFelix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
parent 46d18d51
...@@ -633,14 +633,19 @@ int kfd_set_event(struct kfd_process *p, uint32_t event_id) ...@@ -633,14 +633,19 @@ int kfd_set_event(struct kfd_process *p, uint32_t event_id)
rcu_read_lock(); rcu_read_lock();
ev = lookup_event_by_id(p, event_id); ev = lookup_event_by_id(p, event_id);
if (!ev) {
ret = -EINVAL;
goto unlock_rcu;
}
spin_lock(&ev->lock); spin_lock(&ev->lock);
if (ev && event_can_be_cpu_signaled(ev)) if (event_can_be_cpu_signaled(ev))
set_event(ev); set_event(ev);
else else
ret = -EINVAL; ret = -EINVAL;
spin_unlock(&ev->lock); spin_unlock(&ev->lock);
unlock_rcu:
rcu_read_unlock(); rcu_read_unlock();
return ret; return ret;
} }
...@@ -659,14 +664,19 @@ int kfd_reset_event(struct kfd_process *p, uint32_t event_id) ...@@ -659,14 +664,19 @@ int kfd_reset_event(struct kfd_process *p, uint32_t event_id)
rcu_read_lock(); rcu_read_lock();
ev = lookup_event_by_id(p, event_id); ev = lookup_event_by_id(p, event_id);
if (!ev) {
ret = -EINVAL;
goto unlock_rcu;
}
spin_lock(&ev->lock); spin_lock(&ev->lock);
if (ev && event_can_be_cpu_signaled(ev)) if (event_can_be_cpu_signaled(ev))
reset_event(ev); reset_event(ev);
else else
ret = -EINVAL; ret = -EINVAL;
spin_unlock(&ev->lock); spin_unlock(&ev->lock);
unlock_rcu:
rcu_read_unlock(); rcu_read_unlock();
return ret; return ret;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment