Check the result of kvmalloc_array() in rocket_job_push() and kmalloc_objs() in rocket_job_open() before using the allocated buffer.
Changes in v2: - Free scheds when drm_sched_entity_init() fails. - Initialize ret to 0. Signed-off-by: Triet Hoang <[email protected]> --- drivers/accel/rocket/rocket_job.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/drivers/accel/rocket/rocket_job.c b/drivers/accel/rocket/rocket_job.c index ac51bff39833..24e1a61f71e7 100644 --- a/drivers/accel/rocket/rocket_job.c +++ b/drivers/accel/rocket/rocket_job.c @@ -192,6 +192,9 @@ static int rocket_job_push(struct rocket_job *job) bos = kvmalloc_array(job->in_bo_count + job->out_bo_count, sizeof(void *), GFP_KERNEL); + if (!bos) + return -ENOMEM; + memcpy(bos, job->in_bos, job->in_bo_count * sizeof(void *)); memcpy(&bos[job->in_bo_count], job->out_bos, job->out_bo_count * sizeof(void *)); @@ -499,7 +502,10 @@ int rocket_job_open(struct rocket_file_priv *rocket_priv) struct drm_gpu_scheduler **scheds = kmalloc_objs(*scheds, rdev->num_cores); unsigned int core; - int ret; + int ret = 0; + + if (!scheds) + return -ENOMEM; for (core = 0; core < rdev->num_cores; core++) scheds[core] = &rdev->cores[core].sched; @@ -509,9 +515,9 @@ int rocket_job_open(struct rocket_file_priv *rocket_priv) scheds, rdev->num_cores, NULL); if (WARN_ON(ret)) - return ret; + kfree(scheds); - return 0; + return ret; } void rocket_job_close(struct rocket_file_priv *rocket_priv) -- 2.53.0
