diff mbox series

[2/2] dma-buf: handle empty dma_fence_arrays gracefully

Message ID 20220329070001.134180-2-christian.koenig@amd.com (mailing list archive)
State Not Applicable
Headers
Series [1/2] dma-buf/sync-file: fix logic error in new fence merge code |

Commit Message

Christian König March 29, 2022, 7 a.m. UTC 
  A bug inside the new sync-file merge code created empty dma_fence_array instances.

Warn about that and handle those without crashing.

Signed-off-by: Christian König <christian.koenig@amd.com>
---
 drivers/dma-buf/dma-fence-array.c | 5 +++++
 1 file changed, 5 insertions(+)

Comments

Daniel Vetter March 29, 2022, 8:48 a.m. UTC | #1 
On Tue, Mar 29, 2022 at 09:00:01AM +0200, Christian König wrote:
> A bug inside the new sync-file merge code created empty dma_fence_array instances.
> 
> Warn about that and handle those without crashing.
> 
> Signed-off-by: Christian König <christian.koenig@amd.com>

> ---
>  drivers/dma-buf/dma-fence-array.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/dma-buf/dma-fence-array.c b/drivers/dma-buf/dma-fence-array.c
> index 52b85d292383..5c8a7084577b 100644
> --- a/drivers/dma-buf/dma-fence-array.c
> +++ b/drivers/dma-buf/dma-fence-array.c
> @@ -159,6 +159,8 @@ struct dma_fence_array *dma_fence_array_create(int num_fences,
>  	struct dma_fence_array *array;
>  	size_t size = sizeof(*array);
>  
> +	WARN_ON(!num_fences || !fences);

WARN_ON and then dying randomly is kinda not nice, I'd wrap this in an

if (WARN_ON)
	return NULL;

with that: Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>

> +
>  	/* Allocate the callback structures behind the array. */
>  	size += num_fences * sizeof(struct dma_fence_array_cb);
>  	array = kzalloc(size, GFP_KERNEL);
> @@ -231,6 +233,9 @@ struct dma_fence *dma_fence_array_first(struct dma_fence *head)
>  	if (!array)
>  		return head;
>  
> +	if (!array->num_fences)
> +		return NULL;
> +
>  	return array->fences[0];
>  }
>  EXPORT_SYMBOL(dma_fence_array_first);
> -- 
> 2.25.1
>
Daniel Vetter March 29, 2022, 8:49 a.m. UTC | #2 
On Tue, Mar 29, 2022 at 10:48:10AM +0200, Daniel Vetter wrote:
> On Tue, Mar 29, 2022 at 09:00:01AM +0200, Christian König wrote:
> > A bug inside the new sync-file merge code created empty dma_fence_array instances.
> > 
> > Warn about that and handle those without crashing.
> > 
> > Signed-off-by: Christian König <christian.koenig@amd.com>
> 
> > ---
> >  drivers/dma-buf/dma-fence-array.c | 5 +++++
> >  1 file changed, 5 insertions(+)
> > 
> > diff --git a/drivers/dma-buf/dma-fence-array.c b/drivers/dma-buf/dma-fence-array.c
> > index 52b85d292383..5c8a7084577b 100644
> > --- a/drivers/dma-buf/dma-fence-array.c
> > +++ b/drivers/dma-buf/dma-fence-array.c
> > @@ -159,6 +159,8 @@ struct dma_fence_array *dma_fence_array_create(int num_fences,
> >  	struct dma_fence_array *array;
> >  	size_t size = sizeof(*array);
> >  
> > +	WARN_ON(!num_fences || !fences);
> 
> WARN_ON and then dying randomly is kinda not nice, I'd wrap this in an
> 
> if (WARN_ON)
> 	return NULL;
> 
> with that: Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>

Uh strike that, you handle it gracefully with the check below.

> 
> > +
> >  	/* Allocate the callback structures behind the array. */
> >  	size += num_fences * sizeof(struct dma_fence_array_cb);
> >  	array = kzalloc(size, GFP_KERNEL);
> > @@ -231,6 +233,9 @@ struct dma_fence *dma_fence_array_first(struct dma_fence *head)
> >  	if (!array)
> >  		return head;
> >  

Maybe add a comment here that this is just defensive programming, like

	/* No fences isn't allowed and splats in create, but be defensive */

Either way Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> I guess,
coffee not quite yet working.
-Daniel

> > +	if (!array->num_fences)
> > +		return NULL;
> > +
> >  	return array->fences[0];
> >  }
> >  EXPORT_SYMBOL(dma_fence_array_first);
> > -- 
> > 2.25.1
> > 
> 
> -- 
> Daniel Vetter
> Software Engineer, Intel Corporation
> http://blog.ffwll.ch
diff mbox series

Patch

diff --git a/drivers/dma-buf/dma-fence-array.c b/drivers/dma-buf/dma-fence-array.c
index 52b85d292383..5c8a7084577b 100644
--- a/drivers/dma-buf/dma-fence-array.c
+++ b/drivers/dma-buf/dma-fence-array.c
@@ -159,6 +159,8 @@  struct dma_fence_array *dma_fence_array_create(int num_fences,
 	struct dma_fence_array *array;
 	size_t size = sizeof(*array);
 
+	WARN_ON(!num_fences || !fences);
+
 	/* Allocate the callback structures behind the array. */
 	size += num_fences * sizeof(struct dma_fence_array_cb);
 	array = kzalloc(size, GFP_KERNEL);
@@ -231,6 +233,9 @@  struct dma_fence *dma_fence_array_first(struct dma_fence *head)
 	if (!array)
 		return head;
 
+	if (!array->num_fences)
+		return NULL;
+
 	return array->fences[0];
 }
 EXPORT_SYMBOL(dma_fence_array_first);