Commit abb5bc59 authored by Dan Carpenter's avatar Dan Carpenter Committed by Alex Deucher
Browse files

drm/amdkfd: potential NULL dereference in kfd_set/reset_event() 



If lookup_event_by_id() returns a NULL "ev" pointer then the
spin_lock(&ev->lock) will crash.  This was detected by Smatch:

    drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_events.c:644 kfd_set_event()
    error: we previously assumed 'ev' could be null (see line 639)

Fixes: 5273e82c ("drm/amdkfd: Improve concurrency of event handling")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: default avatarFelix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: default avatarFelix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
parent 46d18d51

drivers/gpu/drm/amd/amdkfd/kfd_events.c

+12 −2
Original line number Diff line number Diff line
@@ -633,14 +633,19 @@ int kfd_set_event(struct kfd_process *p, uint32_t event_id) 
	rcu_read_lock();



	ev = lookup_event_by_id(p, event_id);

	if (!ev) {

		ret = -EINVAL;

		goto unlock_rcu;

	}

	spin_lock(&ev->lock);



	if (ev && event_can_be_cpu_signaled(ev))

	if (event_can_be_cpu_signaled(ev))

		set_event(ev);

	else

		ret = -EINVAL;



	spin_unlock(&ev->lock);

unlock_rcu:

	rcu_read_unlock();

	return ret;

}
@@ -659,14 +664,19 @@ int kfd_reset_event(struct kfd_process *p, uint32_t event_id) 
	rcu_read_lock();



	ev = lookup_event_by_id(p, event_id);

	if (!ev) {

		ret = -EINVAL;

		goto unlock_rcu;

	}

	spin_lock(&ev->lock);



	if (ev && event_can_be_cpu_signaled(ev))

	if (event_can_be_cpu_signaled(ev))

		reset_event(ev);

	else

		ret = -EINVAL;



	spin_unlock(&ev->lock);

unlock_rcu:

	rcu_read_unlock();

	return ret;