drm/amdgpu: fix the error path in amdgpu_vm_pt_alloc()

amdgpu_vm_pt_alloc() drops the eviction lock while it creates the new
page table. When the VM started to get evicted in the meantime,
amdgpu_vm_begin_critical() returns -EBUSY and we jump to error_free_pt
before pt_bo is assigned. That unreferences an uninitialized pointer,
leaks the new page table (still pinned for NPA VMs) and returns 0 since
r is the result of the successful page table creation.

With vm->evicting set right after amdgpu_vm_pt_create() (what
amdgpu_vm_evictable() does when TTM evicts one of the VM page tables in
that window), the first GEM_VA map that needs a new page table oopses:

  BUG: kernel NULL pointer dereference, address: 0000000000000460
  RIP: 0010:amdgpu_bo_unref+0x27/0x70 [amdgpu]
  Call Trace:
   amdgpu_vm_ptes_update+0xa4e/0xa60 [amdgpu]
   amdgpu_vm_update_range+0x2eb/0x970 [amdgpu]
   amdgpu_vm_bo_update+0x325/0x6d0 [amdgpu]
   amdgpu_gem_va_update_vm+0xdb/0x1c0 [amdgpu]
   amdgpu_gem_va_ioctl+0x86c/0x940 [amdgpu]

Assign pt_bo first, unpin and free the new page table and return the
error from amdgpu_vm_begin_critical().

Fixes: 0dc93a683a94 ("drm/amdgpu: rework eviction lock handling into critical section v3")
Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 26b68a5702421d0a235ca5894e3797fc9cdc1ec2)

0 files changed, 0 insertions, 0 deletions