Commit e79a2398 authored by Lee Jones's avatar Lee Jones Committed by Alex Deucher
Browse files

drm/amdkfd: Create file descriptor after client is added to smi_clients list 



This ensures userspace cannot prematurely clean-up the client before
it is fully initialised which has been proven to cause issues in the
past.

Cc: Felix Kuehling <Felix.Kuehling@amd.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: "Christian König" <christian.koenig@amd.com>
Cc: "Pan, Xinhui" <Xinhui.Pan@amd.com>
Cc: David Airlie <airlied@linux.ie>
Cc: Daniel Vetter <daniel@ffwll.ch>
Cc: amd-gfx@lists.freedesktop.org
Cc: dri-devel@lists.freedesktop.org
Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
Reviewed-by: default avatarFelix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: default avatarFelix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
parent ef1a0808

drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c

+15 −9
Original line number Diff line number Diff line
@@ -247,15 +247,6 @@ int kfd_smi_event_open(struct kfd_dev *dev, uint32_t *fd) 
		return ret;

	}



	ret = anon_inode_getfd(kfd_smi_name, &kfd_smi_ev_fops, (void *)client,

			       O_RDWR);

	if (ret < 0) {

		kfifo_free(&client->fifo);

		kfree(client);

		return ret;

	}

	*fd = ret;



	init_waitqueue_head(&client->wait_queue);

	spin_lock_init(&client->lock);

	client->events = 0;
@@ -265,5 +256,20 @@ int kfd_smi_event_open(struct kfd_dev *dev, uint32_t *fd) 
	list_add_rcu(&client->list, &dev->smi_clients);

	spin_unlock(&dev->smi_lock);



	ret = anon_inode_getfd(kfd_smi_name, &kfd_smi_ev_fops, (void *)client,

			       O_RDWR);

	if (ret < 0) {

		spin_lock(&dev->smi_lock);

		list_del_rcu(&client->list);

		spin_unlock(&dev->smi_lock);



		synchronize_rcu();



		kfifo_free(&client->fifo);

		kfree(client);

		return ret;

	}

	*fd = ret;



	return 0;

}