amdgpu_gart_table_ram_alloc() maps the GART dma pages and neither the error path nor amdgpu_gart_table_ram_free() unmaps those pages before freeing them, which could leave the device writing to freed memory.
Fix by unmapping the GART dma pages before freeing them. Signed-off-by: Michail Tatas <[email protected]> --- drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c index c4c21dbbbdbf..780fb01530e6 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c @@ -209,6 +209,8 @@ int amdgpu_gart_table_ram_alloc(struct amdgpu_device *adev) error_resv: amdgpu_bo_unreserve(bo); error: + dma_unmap_page(&adev->pdev->dev, sg_dma_address(sg->sgl), adev->gart.table_size, + DMA_BIDIRECTIONAL); amdgpu_bo_unref(&bo); if (sg) { sg_free_table(sg); @@ -240,6 +242,8 @@ void amdgpu_gart_table_ram_free(struct amdgpu_device *adev) amdgpu_bo_unreserve(adev->gart.bo); } amdgpu_bo_unref(&adev->gart.bo); + dma_unmap_page(&adev->pdev->dev, sg_dma_address(sg->sgl), adev->gart.table_size, + DMA_BIDIRECTIONAL); sg_free_table(sg); kfree(sg); p = virt_to_page(adev->gart.ptr); -- 2.43.0
