From d0a8f98166ff3dc1047b93b0d5c45dd0b6696838 Mon Sep 17 00:00:00 2001 From: Lijo Lazar Date: Tue, 19 May 2026 16:05:36 +0530 Subject: [PATCH] drm/amdxcp: Add more checks to amdxcp Add NULL check to ddev argument and guard pdev_num against underflow. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher --- drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.c b/drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.c index 995cae6be144..84e13537a7ba 100644 --- a/drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.c +++ b/drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.c @@ -45,7 +45,7 @@ static const struct drm_driver amdgpu_xcp_driver = { .minor = 0, }; -static int8_t pdev_num; +static u8 pdev_num; static struct xcp_device *xcp_dev[MAX_XCP_PLATFORM_DEVICE]; static DEFINE_MUTEX(xcp_mutex); @@ -56,6 +56,11 @@ int amdgpu_xcp_drm_dev_alloc(struct drm_device **ddev) char *dev_name; int ret, i; + if (!ddev) + return -EINVAL; + + BUILD_BUG_ON(MAX_XCP_PLATFORM_DEVICE >= U8_MAX); + guard(mutex)(&xcp_mutex); if (pdev_num >= MAX_XCP_PLATFORM_DEVICE) @@ -105,7 +110,7 @@ int amdgpu_xcp_drm_dev_alloc(struct drm_device **ddev) } EXPORT_SYMBOL(amdgpu_xcp_drm_dev_alloc); -static void free_xcp_dev(int8_t index) +static void free_xcp_dev(uint8_t index) { if ((index < MAX_XCP_PLATFORM_DEVICE) && (xcp_dev[index])) { struct platform_device *pdev = xcp_dev[index]->pdev; @@ -114,17 +119,18 @@ static void free_xcp_dev(int8_t index) platform_device_unregister(pdev); xcp_dev[index] = NULL; - pdev_num--; + if (pdev_num > 0) + pdev_num--; } } void amdgpu_xcp_drm_dev_free(struct drm_device *ddev) { - int8_t i; + uint8_t i; guard(mutex)(&xcp_mutex); - for (i = 0; i < MAX_XCP_PLATFORM_DEVICE; i++) { + for (i = 0; pdev_num && i < MAX_XCP_PLATFORM_DEVICE; i++) { if ((xcp_dev[i]) && (&xcp_dev[i]->drm == ddev)) { free_xcp_dev(i); break; @@ -135,7 +141,7 @@ EXPORT_SYMBOL(amdgpu_xcp_drm_dev_free); void amdgpu_xcp_drv_release(void) { - int8_t i; + uint8_t i; guard(mutex)(&xcp_mutex);