AMD General Reviewed-by: Hawking Zhang <[email protected]>
Regards, Hawking -----Original Message----- From: Lazar, Lijo <[email protected]> Sent: Friday, May 29, 2026 5:43 PM To: [email protected] Cc: Zhang, Hawking <[email protected]>; Deucher, Alexander <[email protected]>; Kamal, Asad <[email protected]>; Wang, Yang(Kevin) <[email protected]> Subject: [PATCH] drm/amdxcp: Add more checks to amdxcp Add NULL check to ddev argument and guard pdev_num against underflow. Signed-off-by: Lijo Lazar <[email protected]> --- drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.c b/drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.c index ae40f64369ab..a569163de047 100644 --- a/drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.c +++ b/drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.c @@ -44,7 +44,7 @@ static const struct drm_driver amdgpu_xcp_driver = { .minor = 0, }; -static int8_t pdev_num; +static u8 pdev_num; static struct xcp_device *xcp_dev[MAX_XCP_PLATFORM_DEVICE]; static DEFINE_MUTEX(xcp_mutex); @@ -56,6 +56,10 @@ int amdgpu_xcp_drm_dev_alloc(struct drm_device **ddev) int ret, i; static_assert(sizeof(dev_name) >= sizeof("amdgpu_xcp_") + 10); + if (!ddev) + return -EINVAL; + + BUILD_BUG_ON(MAX_XCP_PLATFORM_DEVICE >= U8_MAX); guard(mutex)(&xcp_mutex); @@ -102,7 +106,7 @@ int amdgpu_xcp_drm_dev_alloc(struct drm_device **ddev) } EXPORT_SYMBOL(amdgpu_xcp_drm_dev_alloc); -static void free_xcp_dev(int8_t index) +static void free_xcp_dev(uint8_t index) { if ((index < MAX_XCP_PLATFORM_DEVICE) && (xcp_dev[index])) { struct platform_device *pdev = xcp_dev[index]->pdev; @@ -111,17 +115,18 @@ static void free_xcp_dev(int8_t index) platform_device_unregister(pdev); xcp_dev[index] = NULL; - pdev_num--; + if (pdev_num > 0) + pdev_num--; } } void amdgpu_xcp_drm_dev_free(struct drm_device *ddev) { - int8_t i; + uint8_t i; guard(mutex)(&xcp_mutex); - for (i = 0; i < MAX_XCP_PLATFORM_DEVICE; i++) { + for (i = 0; pdev_num && i < MAX_XCP_PLATFORM_DEVICE; i++) { if ((xcp_dev[i]) && (&xcp_dev[i]->drm == ddev)) { free_xcp_dev(i); break; @@ -132,7 +137,7 @@ EXPORT_SYMBOL(amdgpu_xcp_drm_dev_free); void amdgpu_xcp_drv_release(void) { - int8_t i; + uint8_t i; guard(mutex)(&xcp_mutex); -- 2.49.0
