diff options
| author | Jesse Zhang <Jesse.Zhang@amd.com> | 2026-11-03 15:05:12 +0800 |
|---|---|---|
| committer | Alex Deucher <alexander.deucher@amd.com> | 2026-11-04 12:44:13 -0500 |
| commit | ade92d50aad6799a5a9d7e73cd1604fd0576e656 (patch) | |
| tree | 7294db2ecbd6281d7b41746a6fe732a9240839b3 /tools/lib/python | |
| parent | e23621a91bb59d22c2e7a0a1b680f3d4acbbdce1 (diff) | |
drm/amdgpu: don't walk the CS chunks when allocating them failed
amdgpu_cs_pass1() sets p->nchunks before allocating p->chunks, and the
allocation failure path skips resetting it. amdgpu_cs_parser_fini() then
frees the kdata of nchunks chunks from a NULL array. On navi48 with the
chunk array allocation failed through failslab:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
RIP: 0010:amdgpu_cs_parser_fini+0x35d/0x710 [amdgpu]
amdgpu_cs_ioctl+0xcae/0x7a20 [amdgpu]
drm_ioctl_kernel+0x180/0x320 [drm]
Set nchunks once the array exists.
Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)")
Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 0c828445757b86aaa3ed2638832d76f450022bdf)
Cc: stable@vger.kernel.org
Diffstat (limited to 'tools/lib/python')
0 files changed, 0 insertions, 0 deletions