drm/amdgpu: Initialize fences array entries in amdgpu_sa_bo_next_hole

Browse source

The entries were only initialized once in amdgpu_sa_bo_new. If a fence
wasn't signalled yet in the first amdgpu_sa_bo_next_hole call, but then
got signalled before a later amdgpu_sa_bo_next_hole call, it could
destroy the fence but leave its pointer in the array, resulting in
use-after-free in amdgpu_sa_bo_new.

Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

...

This commit is contained in:

Michel Dänzer 2018-09-12 18:07:10 +02:00 • committed by Alex Deucher

parent 520cbe0f4a

commit 6a15f3ff19

1 changed files with 3 additions and 3 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

6

drivers/gpu/drm/amd/amdgpu/amdgpu_sa.c

View file