Commit 494f2e42 authored by Philip Yang's avatar Philip Yang Committed by Alex Deucher
Browse files

drm/amdkfd: fix double free mem structure 



drm_gem_object_put calls release_notify callback to free the mem
structure and unreserve_mem_limit, move it down after the last access
of mem and make it conditional call.

Signed-off-by: default avatarPhilip Yang <Philip.Yang@amd.com>
Reviewed-by: default avatarFelix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
parent fc2c456e

drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c

+5 −3
Original line number Diff line number Diff line
@@ -1396,7 +1396,7 @@ int amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu( 
	struct sg_table *sg = NULL;

	uint64_t user_addr = 0;

	struct amdgpu_bo *bo;

	struct drm_gem_object *gobj;

	struct drm_gem_object *gobj = NULL;

	u32 domain, alloc_domain;

	u64 alloc_flags;

	int ret;
@@ -1506,13 +1506,15 @@ int amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu( 
	remove_kgd_mem_from_kfd_bo_list(*mem, avm->process_info);

	drm_vma_node_revoke(&gobj->vma_node, drm_priv);

err_node_allow:

	drm_gem_object_put(gobj);

	/* Don't unreserve system mem limit twice */

	goto err_reserve_limit;

err_bo_create:

	unreserve_mem_limit(adev, size, alloc_domain, !!sg);

err_reserve_limit:

	mutex_destroy(&(*mem)->lock);

	if (gobj)

		drm_gem_object_put(gobj);

	else

		kfree(*mem);

err:

	if (sg) {