From cdadab89f8cc37dd6101e2bbab50037d72e0e1d0 Mon Sep 17 00:00:00 2001 From: Emily Deng Date: Thu, 9 Nov 2017 17:18:18 +0800 Subject: drm/amdgpu: Fix null pointer issue in amdgpu_cs_wait_any_fence MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The array[first] may be null when the fence has already been signaled. BUG: SWDEV-136239 Signed-off-by: Emily Deng Reviewed-by: Christian König Signed-off-by: Alex Deucher --- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c') diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c index f7fceb63413c..146e05f21d35 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c @@ -1497,8 +1497,11 @@ out: memset(wait, 0, sizeof(*wait)); wait->out.status = (r > 0); wait->out.first_signaled = first; - /* set return value 0 to indicate success */ - r = array[first]->error; + + if (array[first]) + r = array[first]->error; + else + r = 0; err_free_fence_array: for (i = 0; i < fence_count; i++) -- cgit v1.2.1 From eb174c77e258f93b0f1046afd23a0aede68be3f2 Mon Sep 17 00:00:00 2001 From: Roger He Date: Fri, 17 Nov 2017 12:45:18 +0800 Subject: drm/amd/amdgpu: fix over-bound accessing in amdgpu_cs_wait_any_fence MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes an oops in amdgpu_cs_wait_any_fence. Reviewed-by: Christian König Reviewed-by: Chunming Zhou Signed-off-by: Roger He Signed-off-by: Alex Deucher --- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c') diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c index 146e05f21d35..bdef497a6a26 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c @@ -1498,7 +1498,7 @@ out: wait->out.status = (r > 0); wait->out.first_signaled = first; - if (array[first]) + if (first < fence_count && array[first]) r = array[first]->error; else r = 0; -- cgit v1.2.1