linux-kernel - Re: [PATCH] drm/amdkfd: fix a potential double free in pqm_create

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <e644fa2a-8000-f83b-7480-efdfa3f4af00@amd.com>
Date:   Wed, 8 Mar 2023 12:42:46 -0500
From:   Felix Kuehling <felix.kuehling@....com>
To:     Chia-I Wu <olvaffe@...il.com>, dri-devel@...ts.freedesktop.org
Cc:     Alex Deucher <alexander.deucher@....com>,
        Christian König <christian.koenig@....com>,
        "Pan, Xinhui" <Xinhui.Pan@....com>,
        David Airlie <airlied@...il.com>,
        Daniel Vetter <daniel@...ll.ch>, amd-gfx@...ts.freedesktop.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] drm/amdkfd: fix a potential double free in
 pqm_create_queue

On 2023-03-07 19:19, Chia-I Wu wrote:
> Set *q to NULL on errors, otherwise pqm_create_queue would free it
> again.
>
> Signed-off-by: Chia-I Wu <olvaffe@...il.com>

Thank you! I'm applying this patch to amd-staging-drm-next.

Reviewed-by: Felix Kuehling <Felix.Kuehling@....com>


> ---
>   drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
> index 5137476ec18e6..4236539d9f932 100644
> --- a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
> +++ b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
> @@ -218,8 +218,8 @@ static int init_user_queue(struct process_queue_manager *pqm,
>   	return 0;
>   
>   cleanup:
> -	if (dev->shared_resources.enable_mes)
> -		uninit_queue(*q);
> +	uninit_queue(*q);
> +	*q = NULL;
>   	return retval;
>   }
>