Commit 3c93603d authored by YuBiao Wang's avatar YuBiao Wang Committed by Alex Deucher
Browse files

drm/amdgpu: Fix use-after-free in amdgpu_cs_ioctl 



[Why]
In amdgpu_cs_ioctl, amdgpu_job_free could be performed ealier if there
is -ERESTARTSYS error. In this case, job->hw_fence could be not
initialized yet. Putting hw_fence during amdgpu_job_free could lead to a
use-after-free warning.

[How]
Check if drm_sched_job_init is performed before job_free by checking
s_fence.

v2: Check hw_fence.ops instead since it could be NULL if fence is not
initialized. Reverse the condition since !=NULL check is discouraged in
kernel.

Signed-off-by: default avatarYuBiao Wang <YuBiao.Wang@amd.com>
Reviewed-by: default avatarAndrey Grodzovsky <andrey.grodzovsky@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
parent d1b4a51a

drivers/gpu/drm/amd/amdgpu/amdgpu_job.c

+4 −1
Original line number Diff line number Diff line
@@ -159,6 +159,9 @@ void amdgpu_job_free(struct amdgpu_job *job) 
	amdgpu_sync_free(&job->sync);

	amdgpu_sync_free(&job->sched_sync);



	if (!job->hw_fence.ops)

		kfree(job);

	else

		dma_fence_put(&job->hw_fence);

}