drm/amdgpu/gfx10: fix out-of-bound mqd_backup array access

Xiaojie Yuan · alexdeucher · commit 908a28be092e · 2019-11-22T14:55:12.000-05:00
Fixes: 0900a9e ("drm/amdgpu/gfx10: fix mqd backup/restore for gfx rings (v2)") Signed-off-by: Xiaojie Yuan <xiaojie.yuan@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
@@ -454,8 +454,6 @@ void amdgpu_gfx_mqd_sw_fini(struct amdgpu_device *adev)
 	}
 
 	ring = &adev->gfx.kiq.ring;
-	if (adev->asic_type >= CHIP_NAVI10 && amdgpu_async_gfx_ring)
-		kfree(adev->gfx.me.mqd_backup[AMDGPU_MAX_GFX_RINGS - 1]);
 	kfree(adev->gfx.mec.mqd_backup[AMDGPU_MAX_COMPUTE_RINGS]);
 	amdgpu_bo_free_kernel(&ring->mqd_obj,
 			      &ring->mqd_gpu_addr,

Original file line number	Diff line number	Diff line change
`@@ -454,8 +454,6 @@ void amdgpu_gfx_mqd_sw_fini(struct amdgpu_device *adev)`
`454`	`454`	`}`
`455`	`455`
`456`	`456`	`ring = &adev->gfx.kiq.ring;`
`457`		`- if (adev->asic_type >= CHIP_NAVI10 && amdgpu_async_gfx_ring)`
`458`		`- kfree(adev->gfx.me.mqd_backup[AMDGPU_MAX_GFX_RINGS - 1]);`
`459`	`457`	`kfree(adev->gfx.mec.mqd_backup[AMDGPU_MAX_COMPUTE_RINGS]);`
`460`	`458`	`amdgpu_bo_free_kernel(&ring->mqd_obj,`
`461`	`459`	`&ring->mqd_gpu_addr,`