[4.9,045/240] drm/amdgpu: fix NULL pointer dereference

Message ID	20210520092110.179707288@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Guchun Chen <guchun.chen@amd.com>, =?utf-8?q?Christian_K=C3=B6nig?= <christian.koenig@amd.com>, Alex Deucher <alexander.deucher@amd.com>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 4.9 045/240] drm/amdgpu: fix NULL pointer dereference Date: Thu, 20 May 2021 11:20:37 +0200 Message-Id: <20210520092110.179707288@linuxfoundation.org> In-Reply-To: <20210520092108.587553970@linuxfoundation.org> References: <20210520092108.587553970@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [4.9,002/240] iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_enqueue_hcmd() [4.9,003/240] ALSA: usb-audio: Add MIDI quirk for Vox ToneLab EX [4.9,004/240] USB: Add LPM quirk for Lenovo ThinkPad USB-C Dock Gen2 Ethernet [4.9,005/240] USB: Add reset-resume quirk for WD19s Realtek Hub [4.9,006/240] platform/x86: thinkpad_acpi: Correct thermal sensor allocation [4.9,007/240] s390/disassembler: increase ebpf disasm buffer size [4.9,008/240] ACPI: custom_method: fix potential use-after-free issue [4.9,009/240] ACPI: custom_method: fix a possible memory leak [4.9,010/240] arm64: dts: mt8173: fix property typo of phys in dsi node [4.9,011/240] ecryptfs: fix kernel panic with null dev_name [4.9,012/240] mmc: core: Do a power cycle when the CMD11 fails [4.9,013/240] mmc: core: Set read only for SD cards with permanent write protect bit [4.9,014/240] btrfs: fix metadata extent leak after failure to create subvolume [4.9,015/240] fbdev: zero-fill colormap in fbcmap.c [4.9,016/240] staging: wimax/i2400m: fix byte-order issue [4.9,017/240] usb: gadget: uvc: add bInterval checking for HS mode [4.9,018/240] usb: dwc3: gadget: Ignore EP queue requests during bus reset [4.9,019/240] usb: xhci: Fix port minor revision [4.9,020/240] PCI: PM: Do not read power state in pci_enable_device_flags() [4.9,021/240] x86/build: Propagate $(CLANG_FLAGS) to $(REALMODE_FLAGS) [4.9,022/240] spi: dln2: Fix reference leak to master [4.9,023/240] spi: omap-100k: Fix reference leak to master [4.9,024/240] intel_th: Consistency and off-by-one fix [4.9,025/240] phy: phy-twl4030-usb: Fix possible use-after-free in twl4030_usb_remove() [4.9,026/240] btrfs: convert logic BUG_ON()s in replace_path to ASSERT()s [4.9,027/240] scsi: target: pscsi: Fix warning in pscsi_complete_cmd() [4.9,028/240] media: ite-cir: check for receive overflow [4.9,029/240] extcon: arizona: Fix some issues when HPDET IRQ fires after the jack has been unplu... [4.9,030/240] media: media/saa7164: fix saa7164_encoder_register() memory leak bugs [4.9,031/240] media: gspca/sq905.c: fix uninitialized variable [4.9,032/240] power: supply: Use IRQF_ONESHOT [4.9,033/240] scsi: qla2xxx: Always check the return value of qla24xx_get_isp_stats() [4.9,034/240] scsi: scsi_dh_alua: Remove check for ASC 24h in alua_rtpg() [4.9,035/240] media: em28xx: fix memory leak [4.9,036/240] clk: socfpga: arria10: Fix memory leak of socfpga_clk on error return [4.9,037/240] power: supply: generic-adc-battery: fix possible use-after-free in gab_remove() [4.9,038/240] power: supply: s3c_adc_battery: fix possible use-after-free in s3c_adc_bat_remove() [4.9,039/240] media: adv7604: fix possible use-after-free in adv76xx_remove() [4.9,040/240] media: i2c: adv7511-v4l2: fix possible use-after-free in adv7511_remove() [4.9,041/240] media: i2c: adv7842: fix possible use-after-free in adv7842_remove() [4.9,042/240] media: dvb-usb: fix memory leak in dvb_usb_adapter_init [4.9,043/240] media: gscpa/stv06xx: fix memory leak [4.9,044/240] drm/msm/mdp5: Configure PP_SYNC_HEIGHT to double the vtotal [4.9,045/240] drm/amdgpu: fix NULL pointer dereference [4.9,046/240] scsi: lpfc: Fix crash when a REG_RPI mailbox fails triggering a LOGO response [4.9,047/240] scsi: libfc: Fix a format specifier [4.9,048/240] ALSA: emu8000: Fix a use after free in snd_emu8000_create_mixer [4.9,049/240] ALSA: sb: Fix two use after free in snd_sb_qsound_build [4.9,050/240] arm64/vdso: Discard .note.gnu.property sections in vDSO [4.9,051/240] openvswitch: fix stack OOB read while fragmenting IPv4 packets [4.9,052/240] NFSv4: Dont discard segments marked for return in _pnfs_return_layout() [4.9,053/240] jffs2: Fix kasan slab-out-of-bounds problem [4.9,054/240] powerpc/eeh: Fix EEH handling for hugepages in ioremap space. [4.9,055/240] powerpc: fix EDEADLOCK redefinition error in uapi/asm/errno.h [4.9,056/240] jffs2: check the validity of dstlen in jffs2_zlib_compress() [4.9,057/240] Revert 337f13046ff0 ("futex: Allow FUTEX_CLOCK_REALTIME with FUTEX_WAIT op") [4.9,058/240] ftrace: Handle commands when closing set_ftrace_filter file [4.9,059/240] ext4: fix check to prevent false positive report of incorrect used inodes [4.9,060/240] ext4: fix error code in ext4_commit_super [4.9,061/240] media: dvbdev: Fix memory leak in dvb_media_device_free() [4.9,062/240] usb: gadget: dummy_hcd: fix gpf in gadget_setup [4.9,063/240] usb: gadget: Fix double free of device descriptor pointers [4.9,064/240] usb: gadget/function/f_fs string table fix for multiple languages [4.9,065/240] dm persistent data: packed struct should have an aligned() attribute too [4.9,066/240] dm space map common: fix division bug in sm_ll_find_free_block() [4.9,067/240] dm rq: fix double free of blk_mq_tag_set in dev remove after table load fails [4.9,068/240] Bluetooth: verify AMP hci_chan before amp_destroy [4.9,069/240] hsr: use netdev_err() instead of WARN_ONCE() [4.9,070/240] bluetooth: eliminate the potential race condition when removing the HCI controller [4.9,071/240] net/nfc: fix use-after-free llcp_sock_bind/connect [4.9,072/240] FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR [4.9,073/240] misc: lis3lv02d: Fix false-positive WARN on various HP models [4.9,074/240] misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct [4.9,075/240] misc: vmw_vmci: explicitly initialize vmci_datagram payload [4.9,076/240] tracing: Treat recording comm for idle task as a success [4.9,077/240] tracing: Use strlcpy() instead of strcpy() in __trace_find_cmdline() [4.9,078/240] tracing: Map all PIDs to command lines [4.9,079/240] tracing: Restructure trace_clock_global() to never block [4.9,080/240] md-cluster: fix use-after-free issue when removing rdev [4.9,081/240] md: factor out a mddev_find_locked helper from mddev_find [4.9,082/240] md: md_open returns -EBUSY when entering racing area [4.9,083/240] ipw2x00: potential buffer overflow in libipw_wx_set_encodeext() [4.9,084/240] cfg80211: scan: drop entry from hidden_list on overflow [4.9,085/240] drm/radeon: fix copy of uninitialized variable back to userspace [4.9,086/240] ALSA: hda/realtek: Re-order ALC882 Acer quirk table entries [4.9,087/240] ALSA: hda/realtek: Re-order ALC882 Sony quirk table entries [4.9,088/240] ALSA: hda/realtek: Re-order ALC269 Sony quirk table entries [4.9,089/240] ALSA: hda/realtek: Re-order ALC269 Lenovo quirk table entries [4.9,090/240] ALSA: hda/realtek: Remove redundant entry for ALC861 Haier/Uniwill devices [4.9,091/240] usb: gadget: pch_udc: Revert d3cb25a12138 completely [4.9,092/240] memory: gpmc: fix out of bounds read and dereference on gpmc_cs[] [4.9,093/240] ARM: dts: exynos: correct PMIC interrupt trigger level on SMDK5250 [4.9,094/240] ARM: dts: exynos: correct PMIC interrupt trigger level on Snow [4.9,095/240] serial: stm32: fix incorrect characters on console [4.9,096/240] usb: gadget: pch_udc: Replace cpu_to_le32() by lower_32_bits() [4.9,097/240] usb: gadget: pch_udc: Check if driver is present before calling ->setup() [4.9,098/240] usb: gadget: pch_udc: Check for DMA mapping error [4.9,099/240] crypto: qat - dont release uninitialized resources [4.9,100/240] crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init [4.9,101/240] fotg210-udc: Fix DMA on EP0 for length > max packet size [4.9,102/240] fotg210-udc: Fix EP0 IN requests bigger than two packets [4.9,103/240] fotg210-udc: Remove a dubious condition leading to fotg210_done [4.9,104/240] fotg210-udc: Mask GRP2 interrupts we dont handle [4.9,105/240] fotg210-udc: Dont DMA more than the buffer can take [4.9,106/240] fotg210-udc: Complete OUT requests on short packets [4.9,107/240] mtd: require write permissions for locking and badblock ioctls [4.9,108/240] bus: qcom: Put child node before return [4.9,109/240] crypto: qat - fix error path in adf_isr_resource_alloc() [4.9,110/240] mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init [4.9,111/240] staging: rtl8192u: Fix potential infinite loop [4.9,112/240] staging: greybus: uart: fix unprivileged TIOCCSERIAL [4.9,113/240] crypto: qat - Fix a double free in adf_create_ring [4.9,114/240] usb: gadget: r8a66597: Add missing null check on return from platform_get_resource [4.9,115/240] USB: cdc-acm: fix unprivileged TIOCCSERIAL [4.9,116/240] tty: actually undefine superseded ASYNC flags [4.9,117/240] tty: fix return value for unsupported ioctls [4.9,118/240] firmware: qcom-scm: Fix QCOM_SCM configuration [4.9,119/240] x86/platform/uv: Fix !KEXEC build failure [4.9,120/240] Drivers: hv: vmbus: Increase wait time for VMbus unload [4.9,121/240] ttyprintk: Add TTY hangup callback. [4.9,122/240] media: vivid: fix assignment of dev->fbuf_out_flags [4.9,123/240] media: omap4iss: return error code when omap4iss_get() failed [4.9,124/240] media: m88rs6000t: avoid potential out-of-bounds reads on arrays [4.9,125/240] pata_arasan_cf: fix IRQ check [4.9,126/240] pata_ipx4xx_cf: fix IRQ check [4.9,127/240] sata_mv: add IRQ checks [4.9,128/240] ata: libahci_platform: fix IRQ check [4.9,129/240] scsi: fcoe: Fix mismatched fcoe_wwn_from_mac declaration [4.9,130/240] media: dvb-usb-remote: fix dvb_usb_nec_rc_key_to_event type mismatch [4.9,131/240] clk: uniphier: Fix potential infinite loop [4.9,132/240] scsi: jazz_esp: Add IRQ check [4.9,133/240] scsi: sun3x_esp: Add IRQ check [4.9,134/240] scsi: sni_53c710: Add IRQ check [4.9,135/240] HSI: core: fix resource leaks in hsi_add_client_from_dt() [4.9,136/240] x86/events/amd/iommu: Fix sysfs type mismatch [4.9,137/240] HID: plantronics: Workaround for double volume key presses [4.9,138/240] perf symbols: Fix dso__fprintf_symbols_by_name() to return the number of printed chars [4.9,139/240] net: lapbether: Prevent racing when checking whether the netif is running [4.9,140/240] powerpc/prom: Mark identical_pvr_fixup as __init [4.9,141/240] ALSA: core: remove redundant spin_lock pair in snd_card_disconnect [4.9,142/240] nfc: pn533: prevent potential memory corruption [4.9,143/240] ALSA: usb-audio: Add error checks for usb_driver_claim_interface() calls [4.9,144/240] liquidio: Fix unintented sign extension of a left shift of a u16 [4.9,145/240] powerpc/perf: Fix PMU constraint check for EBB events [4.9,146/240] powerpc: iommu: fix build when neither PCI or IBMVIO is set [4.9,147/240] mac80211: bail out if cipher schemes are invalid [4.9,148/240] mt7601u: fix always true expression [4.9,149/240] net: thunderx: Fix unintentional sign extension issue [4.9,150/240] i2c: cadence: add IRQ check [4.9,151/240] i2c: emev2: add IRQ check [4.9,152/240] i2c: jz4780: add IRQ check [4.9,153/240] i2c: sh7760: add IRQ check [4.9,154/240] MIPS: pci-legacy: stop using of_pci_range_to_resource [4.9,155/240] powerpc/pseries: extract host bridge from pci_bus prior to bus removal [4.9,156/240] i2c: sh7760: fix IRQ error path [4.9,157/240] mwl8k: Fix a double Free in mwl8k_probe_hw [4.9,158/240] vsock/vmci: log once the failed queue pair allocation [4.9,159/240] RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails [4.9,160/240] net: davinci_emac: Fix incorrect masking of tx and rx error channel [4.9,161/240] ath9k: Fix error check in ath9k_hw_read_revisions() for PCI devices [4.9,162/240] powerpc/52xx: Fix an invalid ASM expression (addi used instead of add) [4.9,163/240] net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send [4.9,164/240] net:nfc:digital: Fix a double free in digital_tg_recv_dep_req [4.9,165/240] kfifo: fix ternary sign extension bugs [4.9,166/240] Revert "net/sctp: fix race condition in sctp_destroy_sock" [4.9,167/240] sctp: delay auto_asconf init until binding the first addr [4.9,168/240] Revert "of/fdt: Make sure no-map does not remove already reserved regions" [4.9,169/240] Revert "fdt: Properly handle "no-map" field in the memory region" [4.9,170/240] fs: dlm: fix debugfs dump [4.9,171/240] tipc: convert dest nodes address to network order [4.9,172/240] net: stmmac: Set FIFO sizes for ipq806x [4.9,173/240] ALSA: hdsp: dont disable if not enabled [4.9,174/240] ALSA: hdspm: dont disable if not enabled [4.9,175/240] ALSA: rme9652: dont disable if not enabled [4.9,176/240] Bluetooth: Set CONF_NOT_COMPLETE as l2cap_chan default [4.9,177/240] Bluetooth: initialize skb_queue_head at l2cap_chan_create() [4.9,178/240] ip6_vti: proper dev_{hold\|put} in ndo_[un]init methods [4.9,179/240] mac80211: clear the beacons CRC after channel switch [4.9,180/240] cuse: prevent clone [4.9,181/240] selftests: Set CC to clang in lib.mk if LLVM is set [4.9,182/240] kconfig: nconf: stop endless search loops [4.9,183/240] sctp: Fix out-of-bounds warning in sctp_process_asconf_param() [4.9,184/240] ASoC: rt286: Generalize support for ALC3263 codec [4.9,185/240] samples/bpf: Fix broken tracex1 due to kprobe argument change [4.9,186/240] powerpc/pseries: Stop calling printk in rtas_stop_self() [4.9,187/240] wl3501_cs: Fix out-of-bounds warnings in wl3501_send_pkt [4.9,188/240] wl3501_cs: Fix out-of-bounds warnings in wl3501_mgmt_join [4.9,189/240] powerpc/iommu: Annotate nested lock for lockdep [4.9,190/240] net: ethernet: mtk_eth_soc: fix RX VLAN offload [4.9,191/240] ASoC: rt286: Make RT286_SET_GPIO_* readable and writable [4.9,192/240] f2fs: fix a redundant call to f2fs_balance_fs if an error occurs [4.9,193/240] PCI: Release OF node in pci_scan_device()s error path [4.9,194/240] ARM: 9064/1: hw_breakpoint: Do not directly check the events overflow_handler hook [4.9,195/240] NFSv4.2: Always flush out writes in nfs42_proc_fallocate() [4.9,196/240] NFS: Deal correctly with attribute generation counter overflow [4.9,197/240] pNFS/flexfiles: fix incorrect size check in decode_nfs_fh() [4.9,198/240] NFSv4.2 fix handling of sr_eof in SEEKs reply [4.9,199/240] sctp: fix a SCTP_MIB_CURRESTAB leak in sctp_sf_do_dupcook_b [4.9,200/240] drm/radeon: Fix off-by-one power_state index heap overwrite [4.9,201/240] khugepaged: fix wrong result value for trace_mm_collapse_huge_page_isolate() [4.9,202/240] mm/hugeltb: handle the error case in hugetlb_fix_reserve_counts() [4.9,203/240] ksm: fix potential missing rmap_item for stable_node [4.9,204/240] kernel: kexec_file: fix error return code of kexec_calculate_store_digests() [4.9,205/240] ARC: entry: fix off-by-one error in syscall number validation [4.9,206/240] powerpc/64s: Fix crashes when toggling entry flush barrier [4.9,207/240] squashfs: fix divide error in calculate_skip() [4.9,208/240] iio: proximity: pulsedlight: Fix rumtime PM imbalance on error [4.9,209/240] usb: fotg210-hcd: Fix an error message [4.9,210/240] ACPI: scan: Fix a memory leak in an error handling path [4.9,211/240] usb: xhci: Increase timeout for HC halt [4.9,212/240] usb: dwc2: Fix gadget DMA unmap direction [4.9,213/240] usb: core: hub: fix race condition about TRSMRCY of resume [4.9,214/240] KVM: x86: Cancel pvclock_gtod_work on module removal [4.9,215/240] FDDI: defxx: Make MMIO the configuration default except for EISA [4.9,216/240] MIPS: Reinstate platform `__div64_32 handler [4.9,217/240] MIPS: Avoid DIVU in `__div64_32 is result would be zero [4.9,218/240] MIPS: Avoid handcoded DIVU in `__div64_32 altogether [4.9,219/240] thermal/core/fair share: Lock the thermal zone while looping over instances [4.9,220/240] dm ioctl: fix out of bounds array access when no devices [4.9,221/240] kobject_uevent: remove warning in init_uevent_argv() [4.9,222/240] netfilter: conntrack: Make global sysctls readonly in non-init netns [4.9,223/240] clk: exynos7: Mark aclk_fsys1_200 as critical [4.9,224/240] x86/msr: Fix wr/rdmsr_safe_regs_on_cpu() prototypes [4.9,225/240] extcon: adc-jack: Fix incompatible pointer type warning [4.9,226/240] kgdb: fix gcc-11 warning on indentation [4.9,227/240] usb: sl811-hcd: improve misleading indentation [4.9,228/240] cxgb4: Fix the -Wmisleading-indentation warning [4.9,229/240] isdn: capi: fix mismatched prototypes [4.9,230/240] ARM: 9058/1: cache-v7: refactor v7_invalidate_l1 to avoid clobbering r5/r6 [4.9,231/240] ACPI / hotplug / PCI: Fix reference count leak in enable_slot() [4.9,232/240] Input: silead - add workaround for x86 BIOS-es which bring the chip up in a stuck s... [4.9,233/240] um: Mark all kernel symbols as local [4.9,234/240] ceph: fix fscache invalidation [4.9,235/240] ALSA: hda: generic: change the DAC ctl name for LO+SPK or LO+HP [4.9,236/240] lib: stackdepot: turn depot_lock spinlock to raw_spinlock [4.9,237/240] sit: proper dev_{hold\|put} in ndo_[un]init methods [4.9,238/240] ip6_tunnel: sit: proper dev_{hold\|put} in ndo_[un]init methods [4.9,239/240] xhci: Do not use GFP_KERNEL in (potentially) atomic context [4.9,240/240] ipv6: remove extra dev_hold() for fallback tunnels

Message ID

20210520092110.179707288@linuxfoundation.org

State

Superseded

Headers

From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org,
	Guchun Chen <guchun.chen@amd.com>, =?utf-8?q?Christian_K=C3=B6nig?=
	<christian.koenig@amd.com>, Alex Deucher <alexander.deucher@amd.com>,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH 4.9 045/240] drm/amdgpu: fix NULL pointer dereference
Date: Thu, 20 May 2021 11:20:37 +0200
Message-Id: <20210520092110.179707288@linuxfoundation.org>
In-Reply-To: <20210520092108.587553970@linuxfoundation.org>
References: <20210520092108.587553970@linuxfoundation.org>
User-Agent: quilt/0.66
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Precedence: bulk

Series

None | expand

Commit Message

Greg KH May 20, 2021, 9:20 a.m. UTC

From: Guchun Chen <guchun.chen@amd.com>

[ Upstream commit 3c3dc654333f6389803cdcaf03912e94173ae510 ]

ttm->sg needs to be checked before accessing its child member.

Call Trace:
 amdgpu_ttm_backend_destroy+0x12/0x70 [amdgpu]
 ttm_bo_cleanup_memtype_use+0x3a/0x60 [ttm]
 ttm_bo_release+0x17d/0x300 [ttm]
 amdgpu_bo_unref+0x1a/0x30 [amdgpu]
 amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x78b/0x8b0 [amdgpu]
 kfd_ioctl_alloc_memory_of_gpu+0x118/0x220 [amdgpu]
 kfd_ioctl+0x222/0x400 [amdgpu]
 ? kfd_dev_is_large_bar+0x90/0x90 [amdgpu]
 __x64_sys_ioctl+0x8e/0xd0
 ? __context_tracking_exit+0x52/0x90
 do_syscall_64+0x33/0x80
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f97f264d317
Code: b3 66 90 48 8b 05 71 4b 2d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 41 4b 2d 00 f7 d8 64 89 01 48
RSP: 002b:00007ffdb402c338 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f97f3cc63a0 RCX: 00007f97f264d317
RDX: 00007ffdb402c380 RSI: 00000000c0284b16 RDI: 0000000000000003
RBP: 00007ffdb402c380 R08: 00007ffdb402c428 R09: 00000000c4000004
R10: 00000000c4000004 R11: 0000000000000246 R12: 00000000c0284b16
R13: 0000000000000003 R14: 00007f97f3cc63a0 R15: 00007f8836200000

Signed-off-by: Guchun Chen <guchun.chen@amd.com>
Acked-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
index 80c60a62d39e..7271e3f32d82 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
@@ -652,7 +652,7 @@  static void amdgpu_ttm_tt_unpin_userptr(struct ttm_tt *ttm)
 		DMA_BIDIRECTIONAL : DMA_TO_DEVICE;
 
 	/* double check that we don't free the table twice */
-	if (!ttm->sg->sgl)
+	if (!ttm->sg || !ttm->sg->sgl)
 		return;
 
 	/* free the sg table and pages again */

[4.9,045/240] drm/amdgpu: fix NULL pointer dereference

Commit Message

Patch