drm/amdgpu: don't leave dangling pointers around

Right now it's possible to trigger fence_drv.fences[] dereference after
the array has been freed. While the real problem is elsewhere, this still
results in confusing errors that depend on how the freed memory was
reused (I've seen "kernel tried to execute NX-protected page"), it's
better to clear them and get NULL dereference so that it's obvious what's
going wrong.

Signed-off-by: Grazvydas Ignotas <notasas@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
index 17e13621fae96e3c9eef313cb9121c42ebc308ad..e203e5561107146badbb45a2260763c87e06f8e0 100644 (file)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
@@ -60,6 +60,7 @@ static int amdgpu_ctx_init(struct amdgpu_device *adev, struct amdgpu_ctx *ctx)
                        amd_sched_entity_fini(&adev->rings[j]->sched,
                                              &ctx->rings[j].entity);
                kfree(ctx->fences);
+               ctx->fences = NULL;
                return r;
        }
        return 0;
@@ -77,6 +78,7 @@ static void amdgpu_ctx_fini(struct amdgpu_ctx *ctx)
                for (j = 0; j < amdgpu_sched_jobs; ++j)
                        fence_put(ctx->rings[i].fences[j]);
        kfree(ctx->fences);
+       ctx->fences = NULL;
 
        for (i = 0; i < adev->num_rings; i++)
                amd_sched_entity_fini(&adev->rings[i]->sched,

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
index 0b109aebfec6ddbd003aac9d782d4c9a2aede8df..3a2e42f4b897647520f49db963412789672d0229 100644 (file)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
@@ -454,6 +454,7 @@ void amdgpu_fence_driver_fini(struct amdgpu_device *adev)
                for (j = 0; j <= ring->fence_drv.num_fences_mask; ++j)
                        fence_put(ring->fence_drv.fences[j]);
                kfree(ring->fence_drv.fences);
+               ring->fence_drv.fences = NULL;
                ring->fence_drv.initialized = false;
        }
 }