qiurui/linux-kernelorg-stable
1
0
Fork 0
mirror of https://kernel.googlesource.com/pub/scm/linux/kernel/git/stable/linux.git synced 2026-09-09 12:01:15 +08:00
Code Issues Packages Projects Releases Wiki Activity

accel/rocket: fix unwinding in error path in rocket_probe

Browse Source 
[ Upstream commit 34f4495a7f ]

When rocket_core_init() fails (as could be the case with EPROBE_DEFER),
we need to properly unwind by decrementing the counter we just
incremented and if this is the first core we failed to probe, remove the
rocket DRM device with rocket_device_fini() as well. This matches the
logic in rocket_remove(). Failing to properly unwind results in
out-of-bounds accesses.

Fixes: 0810d5ad88 ("accel/rocket: Add job submission IOCTL")
Cc: stable@vger.kernel.org
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Reviewed-by: Tomeu Vizoso <tomeu@tomeuvizoso.net>
Signed-off-by: Tomeu Vizoso <tomeu@tomeuvizoso.net>
Link: https://patch.msgid.link/20251215-rocket-error-path-v1-2-eec3bf29dc3b@cherry.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Quentin Schulz
2026-03-12 07:09:26 -04:00
committed by Sasha Levin
parent 1746383916
commit 7fc4b49474
1 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/accel/rocket/rocket_drv.c
+14 -1
View File
@@ -13,6 +13,7 @@
#include <linux/platform_device.h>
#include <linux/pm_runtime.h>
#include "rocket_device.h"
#include "rocket_drv.h"
#include "rocket_gem.h"
#include "rocket_job.h"
@@ -158,6 +159,8 @@ static const struct drm_driver rocket_drm_driver = {
static int rocket_probe(struct platform_device *pdev)
{
int ret;
if (rdev == NULL) {
/* First core probing, initialize DRM device. */
rdev = rocket_device_init(drm_dev, &rocket_drm_driver);
@@ -177,7 +180,17 @@ static int rocket_probe(struct platform_device *pdev)
rdev->num_cores++;
return rocket_core_init(&rdev->cores[core]);
ret = rocket_core_init(&rdev->cores[core]);
if (ret) {
rdev->num_cores--;
if (rdev->num_cores == 0) {
rocket_device_fini(rdev);
rdev = NULL;
}
}
return ret;
}
static void rocket_remove(struct platform_device *pdev)