[PATCH 63/95] drm/amdgpu: Prevent double-free of drm_exec

From: Felix Kuehling <[email protected]>

Always check the return value of amdgpu_ualink_reserve_npa_vm_and_bos.
It's not expected to fail when used in non-interruptible mode. But if it
fails anyway it calls drm_exec_fini. The caller must not call
amdgpu_ualink_unreserve_npa_vm_and_bos in this case to avoid a
double-free.

Signed-off-by: Felix Kuehling <[email protected]>
Reviewed-by: Harish Kasiviswanathan <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c | 26 +++++++++++++++++-----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c
index 1f4eef01e4b74..e2f1829ab844c 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c
@@ -1447,7 +1447,11 @@ static int amdgpu_ualink_unmap_npa_addr(struct amdgpu_device *adev,
 	struct drm_exec exec;
 	int r;
 
-	amdgpu_ualink_reserve_npa_vm_and_bos(adev, bos, ARRAY_SIZE(bos), &exec, false);
+	r = amdgpu_ualink_reserve_npa_vm_and_bos(adev, bos, ARRAY_SIZE(bos), &exec, false);
+	if (unlikely(r)) {
+		dev_err(adev->dev, "Failed to reserve VM and BO in unmap_npa_addr\n");
+		return r;
+	}
 
 	r = amdgpu_vm_update_range(adev, &adev->ualink.npa_vm, false, false, true,
 				false, NULL, npa_addr, npa_addr + size - 1,
@@ -1491,7 +1495,11 @@ static int amdgpu_ualink_map_npa_addr(struct amdgpu_device *adev, u64 npa_addr,
 	struct drm_exec exec;
 	int r;
 
-	amdgpu_ualink_reserve_npa_vm_and_bos(adev, bos, ARRAY_SIZE(bos), &exec, false);
+	r = amdgpu_ualink_reserve_npa_vm_and_bos(adev, bos, ARRAY_SIZE(bos), &exec, false);
+	if (unlikely(r)) {
+		dev_err(adev->dev, "Failed to reserve VM and BO in map_npa_addr\n");
+		return r;
+	}
 
 	r = amdgpu_vm_update_range(adev, vm, false, false, true,
 				false, NULL, npa_addr, npa_addr + size - 1,
@@ -1955,7 +1963,11 @@ static void amdgpu_ualink_force_retry_rpcs(struct amdgpu_device *adev,
 	bo = exp_xa_node->bo;
 	size = amdgpu_bo_ngpu_pages(bo);
 
-	amdgpu_ualink_reserve_npa_vm_and_bos(adev, &bo, 1, &exec, false);
+	r = amdgpu_ualink_reserve_npa_vm_and_bos(adev, &bo, 1, &exec, false);
+	if (unlikely(r)) {
+		dev_err(adev->dev, "Failed to reserve VM and BO in force_retry_rpcs\n");
+		return;
+	}
 
 	for_each_set_bit(remote_acc_id, exp_xa_node->importers_bitmap,
 			 AMDGPU_UALINK_ACCEL_MAX) {
@@ -2081,8 +2093,12 @@ static void amdgpu_ualink_unmap_all_npa_addr(struct amdgpu_device *adev,
 
 	size = amdgpu_bo_ngpu_pages(exp_xa_node->bo);
 
-	amdgpu_ualink_reserve_npa_vm_and_bos(adev, &exp_xa_node->bo, 1,
-					     &exec, false);
+	r = amdgpu_ualink_reserve_npa_vm_and_bos(adev, &exp_xa_node->bo, 1,
+						 &exec, false);
+	if (unlikely(r)) {
+		dev_err(adev->dev, "Failed to reserve VM and BO in unmap_all_npa_addr\n");
+		return;
+	}
 
 	for_each_set_bit(remote_acc_id, exp_xa_node->importers_bitmap,
 			 AMDGPU_UALINK_ACCEL_MAX) {
-- 
2.55.0