Commit 54ddf3a6 authored by Grazvydas Ignotas's avatar Grazvydas Ignotas Committed by Alex Deucher

drm/amdgpu: don't leave dangling pointers around

Right now it's possible to trigger fence_drv.fences[] dereference after
the array has been freed. While the real problem is elsewhere, this still
results in confusing errors that depend on how the freed memory was
reused (I've seen "kernel tried to execute NX-protected page"), it's
better to clear them and get NULL dereference so that it's obvious what's
going wrong.
Signed-off-by: default avatarGrazvydas Ignotas <notasas@gmail.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
parent d8907643
...@@ -60,6 +60,7 @@ static int amdgpu_ctx_init(struct amdgpu_device *adev, struct amdgpu_ctx *ctx) ...@@ -60,6 +60,7 @@ static int amdgpu_ctx_init(struct amdgpu_device *adev, struct amdgpu_ctx *ctx)
amd_sched_entity_fini(&adev->rings[j]->sched, amd_sched_entity_fini(&adev->rings[j]->sched,
&ctx->rings[j].entity); &ctx->rings[j].entity);
kfree(ctx->fences); kfree(ctx->fences);
ctx->fences = NULL;
return r; return r;
} }
return 0; return 0;
...@@ -77,6 +78,7 @@ static void amdgpu_ctx_fini(struct amdgpu_ctx *ctx) ...@@ -77,6 +78,7 @@ static void amdgpu_ctx_fini(struct amdgpu_ctx *ctx)
for (j = 0; j < amdgpu_sched_jobs; ++j) for (j = 0; j < amdgpu_sched_jobs; ++j)
fence_put(ctx->rings[i].fences[j]); fence_put(ctx->rings[i].fences[j]);
kfree(ctx->fences); kfree(ctx->fences);
ctx->fences = NULL;
for (i = 0; i < adev->num_rings; i++) for (i = 0; i < adev->num_rings; i++)
amd_sched_entity_fini(&adev->rings[i]->sched, amd_sched_entity_fini(&adev->rings[i]->sched,
......
...@@ -454,6 +454,7 @@ void amdgpu_fence_driver_fini(struct amdgpu_device *adev) ...@@ -454,6 +454,7 @@ void amdgpu_fence_driver_fini(struct amdgpu_device *adev)
for (j = 0; j <= ring->fence_drv.num_fences_mask; ++j) for (j = 0; j <= ring->fence_drv.num_fences_mask; ++j)
fence_put(ring->fence_drv.fences[j]); fence_put(ring->fence_drv.fences[j]);
kfree(ring->fence_drv.fences); kfree(ring->fence_drv.fences);
ring->fence_drv.fences = NULL;
ring->fence_drv.initialized = false; ring->fence_drv.initialized = false;
} }
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment