mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity

habanalabs: fix NULL pointer dereference 

When polling fences for multi CS, it is possible that fence is
no longer exists (its corresponding CS completed and the fence was
deleted) but we still accessing its parameters, causing NULL pointer
dereference.

Fixed by checking if fence exits before accessing its parameters.

Signed-off-by: Dani Liberman <dliberman@habana.ai>
Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
This commit is contained in:
Dani Liberman 2021-10-06 09:36:19 +03:00 committed by Oded Gabbay
parent ea6eb91c09
commit 81f8582ec4
1 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
drivers/misc/habanalabs/common/command_submission.c
View File

@ -2382,7 +2382,15 @@ static int hl_cs_poll_fences(struct multi_cs_data *mcs_data)
break;
}
mcs_data->stream_master_qid_map |= fence->stream_master_qid_map;
/*
* It is possible to get an old sequence numbers from user
* which related to already completed CSs and their fences
* already gone. In this case, no need to consider its QID for
* mcs completion.
*/
if (fence)
mcs_data->stream_master_qid_map |=
fence->stream_master_qid_map;
/*
* Using mcs_handling_done to avoid possibility of mcs_data
@ -2390,7 +2398,8 @@ static int hl_cs_poll_fences(struct multi_cs_data *mcs_data)
* all of its mcs handling, to avoid race the next time the
* user waits for mcs.
*/
if (status == CS_WAIT_STATUS_BUSY || !fence->mcs_handling_done)
if (status == CS_WAIT_STATUS_BUSY ||
(fence && !fence->mcs_handling_done))
continue;
mcs_data->completion_bitmap |= BIT(i);