diff options
| author | Boris Brezillon <boris.brezillon@collabora.com> | 2021-09-03 14:05:54 +0200 |
|---|---|---|
| committer | Boris Brezillon <boris.brezillon@collabora.com> | 2021-09-07 09:58:26 +0200 |
| commit | d4c16733e7960aa50d6d3bc4a03ee1578baaa47b (patch) | |
| tree | 018f5f404e035d49e67ed13829cd4b878555eaa4 /include/drm | |
| parent | 5bd785a8140333f9162438d0075edd1e432e7ef8 (diff) | |
| download | linux-d4c16733e7960aa50d6d3bc4a03ee1578baaa47b.tar.gz | |
drm/sched: Fix drm_sched_fence_free() so it can be passed an uninitialized fence
drm_sched_job_cleanup() will pass an uninitialized fence to
drm_sched_fence_free(), which will cause to_drm_sched_fence() to return
a NULL fence object, causing a NULL pointer deref when this NULL object
is passed to kmem_cache_free().
Let's create a new drm_sched_fence_free() function that takes a
drm_sched_fence pointer and suffix the old function with _rcu. While at
it, complain if drm_sched_fence_free() is passed an initialized fence
or if drm_sched_fence_free_rcu() is passed an uninitialized fence.
Fixes: dbe48d030b28 ("drm/sched: Split drm_sched_job_init")
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20210903120554.444101-1-boris.brezillon@collabora.com
Diffstat (limited to 'include/drm')
| -rw-r--r-- | include/drm/gpu_scheduler.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/include/drm/gpu_scheduler.h b/include/drm/gpu_scheduler.h index 7f77a455722c..f011e4c407f2 100644 --- a/include/drm/gpu_scheduler.h +++ b/include/drm/gpu_scheduler.h @@ -509,7 +509,7 @@ struct drm_sched_fence *drm_sched_fence_alloc( struct drm_sched_entity *s_entity, void *owner); void drm_sched_fence_init(struct drm_sched_fence *fence, struct drm_sched_entity *entity); -void drm_sched_fence_free(struct rcu_head *rcu); +void drm_sched_fence_free(struct drm_sched_fence *fence); void drm_sched_fence_scheduled(struct drm_sched_fence *fence); void drm_sched_fence_finished(struct drm_sched_fence *fence); |