* [PATCH 1/3] amdgpu: Unlock mutex if base_required is invalid
@ 2015-10-22 16:40 Alex Deucher
2015-10-22 16:40 ` [PATCH 2/3] amdgpu: Fix use-after-free bug in vamgr_deinit Alex Deucher
2015-10-22 16:40 ` [PATCH 3/3] amdgpu: Cleanly handle ENOMEM on result in amdgpu_bo_list_create() Alex Deucher
0 siblings, 2 replies; 3+ messages in thread
From: Alex Deucher @ 2015-10-22 16:40 UTC (permalink / raw
To: dri-devel; +Cc: Tom St Denis
From: Tom St Denis <tom.stdenis@amd.com>
In the function amdgpu_vamgr_find_va() the function would return
without unlocking the mutex if the base_required offset was below
the va managers base offset.
Signed-off-by: Tom St Denis <tom.stdenis@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
---
amdgpu/amdgpu_vamgr.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/amdgpu/amdgpu_vamgr.c b/amdgpu/amdgpu_vamgr.c
index 04d2881..2221da0 100644
--- a/amdgpu/amdgpu_vamgr.c
+++ b/amdgpu/amdgpu_vamgr.c
@@ -124,8 +124,10 @@ amdgpu_vamgr_find_va(struct amdgpu_bo_va_mgr *mgr, uint64_t size,
}
if (base_required) {
- if (base_required < mgr->va_offset)
+ if (base_required < mgr->va_offset) {
+ pthread_mutex_unlock(&mgr->bo_va_mutex);
return AMDGPU_INVALID_VA_ADDRESS;
+ }
offset = mgr->va_offset;
waste = base_required - mgr->va_offset;
} else {
--
1.8.3.1
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH 2/3] amdgpu: Fix use-after-free bug in vamgr_deinit
2015-10-22 16:40 [PATCH 1/3] amdgpu: Unlock mutex if base_required is invalid Alex Deucher
@ 2015-10-22 16:40 ` Alex Deucher
2015-10-22 16:40 ` [PATCH 3/3] amdgpu: Cleanly handle ENOMEM on result in amdgpu_bo_list_create() Alex Deucher
1 sibling, 0 replies; 3+ messages in thread
From: Alex Deucher @ 2015-10-22 16:40 UTC (permalink / raw
To: dri-devel; +Cc: Tom St Denis
From: Tom St Denis <tom.stdenis@amd.com>
This patch fixes a use-after-free bug in the vamgr_deinit function.
Signed-off-by: Tom St Denis <tom.stdenis@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
---
amdgpu/amdgpu_vamgr.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/amdgpu/amdgpu_vamgr.c b/amdgpu/amdgpu_vamgr.c
index 2221da0..8a707cb 100644
--- a/amdgpu/amdgpu_vamgr.c
+++ b/amdgpu/amdgpu_vamgr.c
@@ -57,8 +57,8 @@ drm_private void amdgpu_vamgr_init(struct amdgpu_bo_va_mgr *mgr, uint64_t start,
drm_private void amdgpu_vamgr_deinit(struct amdgpu_bo_va_mgr *mgr)
{
- struct amdgpu_bo_va_hole *hole;
- LIST_FOR_EACH_ENTRY(hole, &mgr->va_holes, list) {
+ struct amdgpu_bo_va_hole *hole, *tmp;
+ LIST_FOR_EACH_ENTRY_SAFE(hole, tmp, &mgr->va_holes, list) {
list_del(&hole->list);
free(hole);
}
--
1.8.3.1
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH 3/3] amdgpu: Cleanly handle ENOMEM on result in amdgpu_bo_list_create()
2015-10-22 16:40 [PATCH 1/3] amdgpu: Unlock mutex if base_required is invalid Alex Deucher
2015-10-22 16:40 ` [PATCH 2/3] amdgpu: Fix use-after-free bug in vamgr_deinit Alex Deucher
@ 2015-10-22 16:40 ` Alex Deucher
1 sibling, 0 replies; 3+ messages in thread
From: Alex Deucher @ 2015-10-22 16:40 UTC (permalink / raw
To: dri-devel; +Cc: Tom St Denis
From: Tom St Denis <tom.stdenis@amd.com>
Move the allocation of result prior to the IOCTL so we can cleanly
backtrack if the allocation fails.
Signed-off-by: Tom St Denis <tom.stdenis@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
---
amdgpu/amdgpu_bo.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/amdgpu/amdgpu_bo.c b/amdgpu/amdgpu_bo.c
index 348da00..1a5a401 100644
--- a/amdgpu/amdgpu_bo.c
+++ b/amdgpu/amdgpu_bo.c
@@ -591,6 +591,12 @@ int amdgpu_bo_list_create(amdgpu_device_handle dev,
if (!list)
return -ENOMEM;
+ *result = malloc(sizeof(struct amdgpu_bo_list));
+ if (!*result) {
+ free(list);
+ return -ENOMEM;
+ }
+
memset(&args, 0, sizeof(args));
args.in.operation = AMDGPU_BO_LIST_OP_CREATE;
args.in.bo_number = number_of_resources;
@@ -608,10 +614,11 @@ int amdgpu_bo_list_create(amdgpu_device_handle dev,
r = drmCommandWriteRead(dev->fd, DRM_AMDGPU_BO_LIST,
&args, sizeof(args));
free(list);
- if (r)
+ if (r) {
+ free(*result);
return r;
+ }
- *result = malloc(sizeof(struct amdgpu_bo_list));
(*result)->dev = dev;
(*result)->handle = args.out.list_handle;
return 0;
--
1.8.3.1
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2015-10-22 16:40 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-10-22 16:40 [PATCH 1/3] amdgpu: Unlock mutex if base_required is invalid Alex Deucher
2015-10-22 16:40 ` [PATCH 2/3] amdgpu: Fix use-after-free bug in vamgr_deinit Alex Deucher
2015-10-22 16:40 ` [PATCH 3/3] amdgpu: Cleanly handle ENOMEM on result in amdgpu_bo_list_create() Alex Deucher
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).