tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

accel/rocket: fix unwinding in error path in rocket_probe

When rocket_core_init() fails (as could be the case with EPROBE_DEFER),
we need to properly unwind by decrementing the counter we just
incremented and if this is the first core we failed to probe, remove the
rocket DRM device with rocket_device_fini() as well. This matches the
logic in rocket_remove(). Failing to properly unwind results in
out-of-bounds accesses.

Fixes: 0810d5ad88a1 ("accel/rocket: Add job submission IOCTL")
Cc: stable@vger.kernel.org
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Reviewed-by: Tomeu Vizoso <tomeu@tomeuvizoso.net>
Signed-off-by: Tomeu Vizoso <tomeu@tomeuvizoso.net>
Link: https://patch.msgid.link/20251215-rocket-error-path-v1-2-eec3bf29dc3b@cherry.de

authored by

Quentin Schulz and committed by
Tomeu Vizoso 34f4495a f509a081

+14 -1
+14 -1
drivers/accel/rocket/rocket_drv.c
··· 13 13 #include <linux/platform_device.h> 14 14 #include <linux/pm_runtime.h> 15 15 16 + #include "rocket_device.h" 16 17 #include "rocket_drv.h" 17 18 #include "rocket_gem.h" 18 19 #include "rocket_job.h" ··· 159 158 160 159 static int rocket_probe(struct platform_device *pdev) 161 160 { 161 + int ret; 162 + 162 163 if (rdev == NULL) { 163 164 /* First core probing, initialize DRM device. */ 164 165 rdev = rocket_device_init(drm_dev, &rocket_drm_driver); ··· 180 177 181 178 rdev->num_cores++; 182 179 183 - return rocket_core_init(&rdev->cores[core]); 180 + ret = rocket_core_init(&rdev->cores[core]); 181 + if (ret) { 182 + rdev->num_cores--; 183 + 184 + if (rdev->num_cores == 0) { 185 + rocket_device_fini(rdev); 186 + rdev = NULL; 187 + } 188 + } 189 + 190 + return ret; 184 191 } 185 192 186 193 static void rocket_remove(struct platform_device *pdev)