Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [PATCH] drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a
 dma_fence obj
To:     Xin Xiong <xiongx18@fudan.edu.cn>,
        Alex Deucher <alexander.deucher@amd.com>,
        "Pan, Xinhui" <Xinhui.Pan@amd.com>,
        David Airlie <airlied@linux.ie>,
        Daniel Vetter <daniel@ffwll.ch>,
        Sumit Semwal <sumit.semwal@linaro.org>,
        amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org,
        linux-kernel@vger.kernel.org, linux-media@vger.kernel.org,
        linaro-mm-sig@lists.linaro.org
Cc:     yuanxzhang@fudan.edu.cn, Xin Tan <tanxin.ctf@gmail.com>
References: <20220121052827.4384-1-xiongx18@fudan.edu.cn>
From:   =?UTF-8?Q?Christian_K=c3=b6nig?= <christian.koenig@amd.com>
Message-ID: <23d5251f-c910-aed3-5d9e-07d6e5e5add2@amd.com>
Date:   Fri, 21 Jan 2022 08:45:06 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.14.0
In-Reply-To: <20220121052827.4384-1-xiongx18@fudan.edu.cn>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-US
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?M2FEZnFPUDVybTNZRDVIMTU3NTgxc2UzbWFrSjJqR2N4K3h2c0FyS1FseU1w?=
 =?utf-8?B?WS9teEhISyt3c09DUDFyL0ZSWjdiYXZuc1VHYmNUYjl5cWVPL1JsTi9leFlJ?=
 =?utf-8?B?TXU0Mk4xMTBhUmIvZ0lJUmJkYXVBZFc0ZVlndDhlKzQ3eHFOL1poQm05eUdW?=
 =?utf-8?B?dFdjWXlFV21LK3B5Y0NybkhNK0YyaGZseTVIanhQRmY0N3I5bkRXVEtIMUQr?=
 =?utf-8?B?Znl1bDZBVHhidGxNMC81RGo0M3pzd3B5V0w0MldlZE4yMStpUGErY0crbXUz?=
 =?utf-8?B?dG91UHExUDY2cFIyV1JGME5KQmVHSU5obXR2V3YyWDFkejBrNlNuNk1iUHFx?=
 =?utf-8?B?SjRGRExUWlVUMDIySUNmdENrYzRIY2taZDcyYWh4aXA0Q1BPREhnRGowaGF0?=
 =?utf-8?B?QnQ0Y1oybng5WHJ0MXo3WE4yRTlKQitOYlJ5azYvQ1J0dzNBL3VURy9IVzdJ?=
 =?utf-8?B?UmR2RnYxQ3MrRitNSFdEdVd5K28yWXUwVnVBOVM4Uis0SlVpUVFUcmlTZFVU?=
 =?utf-8?B?T1RVUzQ3T3d6djVqUWU4QXlGK0ZuWGNmOVIyT3RVMmlQemxJT0dHZGZjOEc4?=
 =?utf-8?B?bGpyM1M5ZzNrNjh1MHBucWM0YXhhbUp3Wko3dkNMQy9xeGFnY0pwbXV6Tmsz?=
 =?utf-8?B?R0Z2VWlWa1VHdUdETUFnajUyUTlHb09scDg2djlpcW1zcDRZS3hmbHpjRHVy?=
 =?utf-8?B?YlM0c1pKMDJmVVJ2RDB3U1lRYnFoM3FJOW55ZFlhOGl3OXJ1RE85bk9hN3N5?=
 =?utf-8?B?UGFmTnpCSG9HMlpqZ3J1eGdGc1cxTHFyVjdwRWhybHAvdzFLNGtRaVI0NG1v?=
 =?utf-8?B?QmtmMjRwMWh5dmgzakJhVXBrWGY2STh4emZpcVNMakNlNHVsZlBQZms2KzFs?=
 =?utf-8?B?UnJFOFcxa3MyWjh4cGxlSWpYWE1mZFlVME5lV1FMNWwra21ITW1zK25ISEc4?=
 =?utf-8?B?TURKYVpRKzhjTUJLMGxzNkpselAxSVJrakFRekhKdGJobmpmYmpzNGdYZUNG?=
 =?utf-8?B?RnpUSlArRHVjajIvR2Y5SFAraXA0UHIvN21PSFhBV1RVOGMwVmo5eGdRdU13?=
 =?utf-8?B?RUpBQk1CS09yd05sMzJuZC9kaU1uVStiL0QvQzdwdW5VVERiR2pvTnVXK3RG?=
 =?utf-8?B?aUFwUjhVeDlnaUZoUHVDTTRpVGM2dnJTV05LWjZsbS82eWJUUXUxVDIrb3Nm?=
 =?utf-8?B?ekN0SS9tL3d2Z2V6Nm9YUVhsSnJmVkNEMUw2dUtlbFJtUElBcXZlSVVjM3VY?=
 =?utf-8?B?d3IvaEY3WTAyTnhWRXAvaUFVVXcwSzBlME14M0ZkWEFtbDcxby9RdnMwelJF?=
 =?utf-8?B?bVg4QU95VkxLZ21UTzV2SHVrOFZIQzNsc0dQOS9WMjlITEVwbU1QVjJNcDhy?=
 =?utf-8?B?UmhEYlVsYm5UUkJOZHNsVkhYNHNTUkoxakhDYkIrWm8rWXJtRzhsMksyTGI3?=
 =?utf-8?B?RnpyYjA3MVlqWEI2VTFjYitXNi9rbXZjWHJzNlhpeDZDbGJNYW85NjdNRGNU?=
 =?utf-8?B?ektEdGdJSHl5ZHhLa3FxUHRCRzBhaGxkNkpVZkpnRlFOdzBxSE0zWFpaSk8x?=
 =?utf-8?B?S3RqODNQcGQ4THdDbzhxY2JuODRabzJzQ3lTai9oZVBDVmlkbGV3UGVnUzR2?=
 =?utf-8?B?WHhrNDFzUTFxU2lrckI4WUZYdWZjcmszcExiTkhLLzV4aTZtbVVNYldxRjk2?=
 =?utf-8?B?ZEVqNDVpNHMvTW9WNnh6ZmF6clZjRzdkRTVYTjhlYlU1YlN4dGxHYjZVQ3dn?=
 =?utf-8?B?WWl6MEpDK3NmY0pRNkM2N2hCZ3hINE9ua1YybHEvdHpnU1k1N05hNXR2TnVS?=
 =?utf-8?B?ekdoNjN4WHFCcXhWZnNXSFZKTm1pUldKWllFZXJ2WGVsNUk1T2lSTVYrRHJn?=
 =?utf-8?B?anpZMFBKanljdGxQK3kzZTljT0NmWTFxU0dnNWh2Vi9NVmtOVFd0VXIyYjBY?=
 =?utf-8?B?NlE5SExYR1ZyT3k5aXI2QS9Fd1BzSlN1dldNQlpXaUR6Y0p4VE8yODRtTVpD?=
 =?utf-8?B?bkUvNEluOVNvTTVEV2ErVVBDd2h4d0N5ampVbnpPNnc2ZlltTXFzQ2pOVkEy?=
 =?utf-8?B?dHNoT2w0QitodkpUa0luNmVTZWswNmRSSXhXc2pZNDNONDg4R2UxWXZnWXF6?=
 =?utf-8?B?NS9WdEZiTTJqY0o3TUp0cVI3NmNwYS8wWkxMTnV4TzI4UWxjcmVWVTR1c0Ni?=
 =?utf-8?Q?+O5kZsvxWVbIxh+6gqRTwRs=3D?=
X-OriginatorOrg: amd.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 0dd3f7ab-8835-461b-7aa6-08d9dcb1f4ef
X-MS-Exchange-CrossTenant-AuthSource: BN8PR12MB3587.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Jan 2022 07:45:12.7230
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 4u5/H12HeZEwGqRLdbVBruYKfinZXtGyrEpRcMiybUXET7aSRVRoykhV5ZAwGYAY
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR12MB1201
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Am 21.01.22 um 06:28 schrieb Xin Xiong:
> This issue takes place in an error path in
> amdgpu_cs_fence_to_handle_ioctl(). When `info->in.what` falls into
> default case, the function simply returns -EINVAL, forgetting to
> decrement the reference count of a dma_fence obj, which is bumped
> earlier by amdgpu_cs_get_fence(). This may result in reference count
> leaks.
>
> Fix it by decreasing the refcount of specific object before returning
> the error code.
>
> Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
> Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>

Good catch. Reviewed-by: Christian König <christian.koenig@amd.com>

> ---
>   drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 1 +
>   1 file changed, 1 insertion(+)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> index 0311d799a..894869789 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> @@ -1510,6 +1510,7 @@ int amdgpu_cs_fence_to_handle_ioctl(struct drm_device *dev, void *data,
>   		return 0;
>   
>   	default:
> +		dma_fence_put(fence);
>   		return -EINVAL;
>   	}
>   }