From 81f8582ec404b2ab3ec1d412e33703e014fc3121 Mon Sep 17 00:00:00 2001 From: Dani Liberman Date: Wed, 6 Oct 2021 09:36:19 +0300 Subject: [PATCH] habanalabs: fix NULL pointer dereference When polling fences for multi CS, it is possible that fence is no longer exists (its corresponding CS completed and the fence was deleted) but we still accessing its parameters, causing NULL pointer dereference. Fixed by checking if fence exits before accessing its parameters. Signed-off-by: Dani Liberman Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay --- drivers/misc/habanalabs/common/command_submission.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/drivers/misc/habanalabs/common/command_submission.c b/drivers/misc/habanalabs/common/command_submission.c index 8e4dc1441fffb..a3358cc3c877c 100644 --- a/drivers/misc/habanalabs/common/command_submission.c +++ b/drivers/misc/habanalabs/common/command_submission.c @@ -2382,7 +2382,15 @@ static int hl_cs_poll_fences(struct multi_cs_data *mcs_data) break; } - mcs_data->stream_master_qid_map |= fence->stream_master_qid_map; + /* + * It is possible to get an old sequence numbers from user + * which related to already completed CSs and their fences + * already gone. In this case, no need to consider its QID for + * mcs completion. + */ + if (fence) + mcs_data->stream_master_qid_map |= + fence->stream_master_qid_map; /* * Using mcs_handling_done to avoid possibility of mcs_data @@ -2390,7 +2398,8 @@ static int hl_cs_poll_fences(struct multi_cs_data *mcs_data) * all of its mcs handling, to avoid race the next time the * user waits for mcs. */ - if (status == CS_WAIT_STATUS_BUSY || !fence->mcs_handling_done) + if (status == CS_WAIT_STATUS_BUSY || + (fence && !fence->mcs_handling_done)) continue; mcs_data->completion_bitmap |= BIT(i); -- 2.30.2