From patchwork Thu May 11 11:23:14 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniil Dulov X-Patchwork-Id: 92502 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b0ea:0:b0:3b6:4342:cba0 with SMTP id b10csp4319620vqo; Thu, 11 May 2023 05:12:02 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ4fmrdoVSQBPvqDh0ApvahQfArdHgvRoq5h7iiD1ATARP26zBL3PIDeR9Bwv+8jNVCdzrgJ X-Received: by 2002:a05:6a21:3a8b:b0:f3:756e:e116 with SMTP id zv11-20020a056a213a8b00b000f3756ee116mr20494435pzb.38.1683807121846; Thu, 11 May 2023 05:12:01 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1683807121; cv=none; d=google.com; s=arc-20160816; b=PvBPAh9ewiPdxDAGMdtfEW9w0hc3KS+6wdEzrI89VuxwlkZBvP7otHEYvMpVGc6cUM oIxDyJwSG0RLDAseXxbF9/LQ32IrNcidYP2+zYWqxAOYnw/RhD0cwRv7q8Gkm5PTyxYZ +q3CidVLcEnmK3M1mx3MSOF/c86pM70tUlCoPbrIsRq+JihI9G2zwidXaikew2ocZ+wl BeCrd8Ni4GoWxrni+xrARku7SQ7uGzCw0gwb4gp4sPmvvDPJkV+75ZjINDhtAQmtzos2 99BCQaplq8MYyJGy9OBquAg+yWJhtok3SxTBoZK3aYq5G/BncUTm5Vc64pMdw4z/4jFv 8Rhw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from; bh=/ERSl0qHjIbwi8MtUVkne7Iy4A+Gv+CLVSDubJ5syvg=; b=sxzjfm1P1Zk+jTjD21U15vnxukvThvlDnLI1qJi3SNBRBZNEctny946acO8HB3Wbsq 2TBFS+sWc3yh7cQgikUk0n8fIpP+nluhyV86RxM4yIumGlirABsn/nbNvff+nDedru9l GIrEnMsp17zfvAW0+ADzO4Ks4yGwbX9qTaa3rwL1BpD6CERCYhI7S85e6LURzq8/IM1M LnCzOKJfpC9Ajg3qZ/TGd1j4gSmzxYCz9jy8TlEVjDgs79h86RdJxp5bgzD2qijm+8a1 f4EdV53IuyJ8OOCJLfEG2sQLPNk8fVYsuIGqjbTPkYcQIxi5BjegEcm3RjixQlr9yPXb z4pA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=aladdin.ru Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id s21-20020a63af55000000b005285958c85bsi1821256pgo.807.2023.05.11.05.11.47; Thu, 11 May 2023 05:12:01 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=aladdin.ru Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237868AbjEKL1r (ORCPT + 99 others); Thu, 11 May 2023 07:27:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55322 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229609AbjEKL1p (ORCPT ); Thu, 11 May 2023 07:27:45 -0400 Received: from mail-out.aladdin-rd.ru (mail-out.aladdin-rd.ru [91.199.251.16]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 01797558D for ; Thu, 11 May 2023 04:27:40 -0700 (PDT) From: Daniil Dulov To: Felix Kuehling CC: Daniil Dulov , Alex Deucher , =?utf-8?q?Christian_K=C3=B6nig?= , David Airlie , Daniel Vetter , Oak Zeng , , , , "# v5 . 3+" , Subject: [PATCH v2] drm/amdkfd: Fix potential deallocation of previously deallocated memory. Date: Thu, 11 May 2023 04:23:14 -0700 Message-ID: <20230511112314.29322-1-d.dulov@aladdin.ru> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 X-Originating-IP: [10.0.20.125] X-ClientProxiedBy: EXCH-2016-02.aladdin.ru (192.168.1.102) To EXCH-2016-02.aladdin.ru (192.168.1.102) X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,SPF_HELO_NONE, SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1763496639477765377?= X-GMAIL-MSGID: =?utf-8?q?1765599736168482711?= Pointer mqd_mem_obj can be deallocated in kfd_gtt_sa_allocate(). The function then returns non-zero value, which causes the second deallocation. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: d1f8f0d17d40 ("drm/amdkfd: Move non-sdma mqd allocation out of init_mqd") Signed-off-by: Daniil Dulov Reviewed-by: Felix Kuehling --- v2: Move if (retval) inside previous if as Andi Shyti suggested. drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c index 3b6f5963180d..dadeb2013fd9 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c @@ -113,18 +113,19 @@ static struct kfd_mem_obj *allocate_mqd(struct kfd_dev *kfd, &(mqd_mem_obj->gtt_mem), &(mqd_mem_obj->gpu_addr), (void *)&(mqd_mem_obj->cpu_ptr), true); + + if (retval) { + kfree(mqd_mem_obj); + return NULL; + } } else { retval = kfd_gtt_sa_allocate(kfd, sizeof(struct v9_mqd), &mqd_mem_obj); - } - - if (retval) { - kfree(mqd_mem_obj); - return NULL; + if (retval) + return NULL; } return mqd_mem_obj; - } static void init_mqd(struct mqd_manager *mm, void **mqd,