Skip to content

Commit f85294c

Browse files
bvanasscheSasha Levin
authored andcommitted
drm/amdgpu: Fix locking bugs in error paths
[ Upstream commit 480ad5f ] Do not unlock psp->ras_context.mutex if it has not been locked. This has been detected by the Clang thread-safety analyzer. Cc: Alex Deucher <alexander.deucher@amd.com> Cc: Christian König <christian.koenig@amd.com> Cc: YiPeng Chai <YiPeng.Chai@amd.com> Cc: Hawking Zhang <Hawking.Zhang@amd.com> Cc: amd-gfx@lists.freedesktop.org Fixes: b3fb79c ("drm/amdgpu: add mutex to protect ras shared memory") Acked-by: Christian König <christian.koenig@amd.com> Signed-off-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 6fa01b4335978051d2cd80841728fd63cc597970) Signed-off-by: Sasha Levin <sashal@kernel.org>
1 parent 6f6f1ff commit f85294c

File tree

1 file changed

+7
-5
lines changed

1 file changed

+7
-5
lines changed

drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -332,37 +332,39 @@ static ssize_t ta_if_invoke_debugfs_write(struct file *fp, const char *buf, size
332332
if (!context || !context->initialized) {
333333
dev_err(adev->dev, "TA is not initialized\n");
334334
ret = -EINVAL;
335-
goto err_free_shared_buf;
335+
goto free_shared_buf;
336336
}
337337

338338
if (!psp->ta_funcs || !psp->ta_funcs->fn_ta_invoke) {
339339
dev_err(adev->dev, "Unsupported function to invoke TA\n");
340340
ret = -EOPNOTSUPP;
341-
goto err_free_shared_buf;
341+
goto free_shared_buf;
342342
}
343343

344344
context->session_id = ta_id;
345345

346346
mutex_lock(&psp->ras_context.mutex);
347347
ret = prep_ta_mem_context(&context->mem_context, shared_buf, shared_buf_len);
348348
if (ret)
349-
goto err_free_shared_buf;
349+
goto unlock;
350350

351351
ret = psp_fn_ta_invoke(psp, cmd_id);
352352
if (ret || context->resp_status) {
353353
dev_err(adev->dev, "Failed to invoke TA via debugfs (%d) and status (0x%X)\n",
354354
ret, context->resp_status);
355355
if (!ret) {
356356
ret = -EINVAL;
357-
goto err_free_shared_buf;
357+
goto unlock;
358358
}
359359
}
360360

361361
if (copy_to_user((char *)&buf[copy_pos], context->mem_context.shared_buf, shared_buf_len))
362362
ret = -EFAULT;
363363

364-
err_free_shared_buf:
364+
unlock:
365365
mutex_unlock(&psp->ras_context.mutex);
366+
367+
free_shared_buf:
366368
kfree(shared_buf);
367369

368370
return ret;

0 commit comments

Comments
 (0)