drm/amdkfd: fix a potential double free in pqm_create_queue

[PATCH] drm/amdkfd: fix a potential double free in pqm_create_queue

Posted by Chia-I Wu 2 years, 6 months ago

Set *q to NULL on errors, otherwise pqm_create_queue would free it
again.

Signed-off-by: Chia-I Wu <olvaffe@gmail.com>
---
 drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
index 5137476ec18e6..4236539d9f932 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
@@ -218,8 +218,8 @@ static int init_user_queue(struct process_queue_manager *pqm,
 	return 0;
 
 cleanup:
-	if (dev->shared_resources.enable_mes)
-		uninit_queue(*q);
+	uninit_queue(*q);
+	*q = NULL;
 	return retval;
 }
 
-- 
2.40.0.rc0.216.gc4246ad0f0-goog

Re: [PATCH] drm/amdkfd: fix a potential double free in pqm_create_queue

Posted by Felix Kuehling 2 years, 6 months ago

On 2023-03-07 19:19, Chia-I Wu wrote:
> Set *q to NULL on errors, otherwise pqm_create_queue would free it
> again.
>
> Signed-off-by: Chia-I Wu <olvaffe@gmail.com>

Thank you! I'm applying this patch to amd-staging-drm-next.

Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>


> ---
>   drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
> index 5137476ec18e6..4236539d9f932 100644
> --- a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
> +++ b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
> @@ -218,8 +218,8 @@ static int init_user_queue(struct process_queue_manager *pqm,
>   	return 0;
>   
>   cleanup:
> -	if (dev->shared_resources.enable_mes)
> -		uninit_queue(*q);
> +	uninit_queue(*q);
> +	*q = NULL;
>   	return retval;
>   }
>