If the first PFN-array allocation in amdgpu_hmm_range_get_pages() fails,
the allocated HMM range still has a NULL notifier. The validity condition
in svm_range_validate_and_map() calls amdgpu_hmm_range_valid() before
checking the error, dereferencing that NULL notifier.

Check the error first so failed requests retain their original error and
reach the existing cleanup without testing an uninitialized HMM range.

Fixes: c0de552910bb ("drm/amdkfd: clean up the code to free hmm_range")
Signed-off-by: Aveline Noir <[email protected]>
---
 drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c 
b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
index 8184cbbb829e..79455e23a030 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
@@ -1901,7 +1901,7 @@ static int svm_range_validate_and_map(struct mm_struct 
*mm,
                 * Override return value to TRY AGAIN only if prior returns
                 * were successful
                 */
-               if (range && !amdgpu_hmm_range_valid(range) && !r) {
+               if (!r && range && !amdgpu_hmm_range_valid(range)) {
                        pr_debug("hmm update the range, need validate again\n");
                        r = -EAGAIN;
                }

-- 
2.56.0

Reply via email to