drm/amdgpu: fix array out of bounds accesses for mes sw_fini

The mes.fw[] is per-pipe resource shared accross xcc inst.
And enlarge hung_queue array to max inst_pipes.

Signed-off-by: Le Ma <le.ma@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.h
index bcf2a067dc4100e00350305b30674976e4fecfbe..f80e3aca9c78efe6995beac234781cfd1cadf1db 100644 (file)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.h
@@ -159,9 +159,9 @@ struct amdgpu_mes {
 
        int                             hung_queue_db_array_size;
        int                             hung_queue_hqd_info_offset;
-       struct amdgpu_bo                *hung_queue_db_array_gpu_obj[AMDGPU_MAX_MES_PIPES];
-       uint64_t                        hung_queue_db_array_gpu_addr[AMDGPU_MAX_MES_PIPES];
-       void                            *hung_queue_db_array_cpu_addr[AMDGPU_MAX_MES_PIPES];
+       struct amdgpu_bo                *hung_queue_db_array_gpu_obj[AMDGPU_MAX_MES_INST_PIPES];
+       uint64_t                        hung_queue_db_array_gpu_addr[AMDGPU_MAX_MES_INST_PIPES];
+       void                            *hung_queue_db_array_cpu_addr[AMDGPU_MAX_MES_INST_PIPES];
 
        /* cooperative dispatch */
        bool                enable_coop_mode;

diff --git a/drivers/gpu/drm/amd/amdgpu/mes_v12_1.c b/drivers/gpu/drm/amd/amdgpu/mes_v12_1.c
index 7b8c670d0a9edae0f94071ae3b1437dcf5086e75..d8e4b52bdfd5044718ba9226c389338b706b998b 100644 (file)
--- a/drivers/gpu/drm/amd/amdgpu/mes_v12_1.c
+++ b/drivers/gpu/drm/amd/amdgpu/mes_v12_1.c
@@ -1611,7 +1611,6 @@ static int mes_v12_1_sw_fini(struct amdgpu_ip_block *ip_block)
                        amdgpu_bo_free_kernel(&adev->mes.eop_gpu_obj[inst],
                                              &adev->mes.eop_gpu_addr[inst],
                                              NULL);
-                       amdgpu_ucode_release(&adev->mes.fw[inst]);
 
                        if (adev->enable_uni_mes || pipe == AMDGPU_MES_SCHED_PIPE) {
                                amdgpu_bo_free_kernel(&adev->mes.ring[inst].mqd_obj,
@@ -1622,6 +1621,9 @@ static int mes_v12_1_sw_fini(struct amdgpu_ip_block *ip_block)
                }
        }
 
+       for (pipe = 0; pipe < AMDGPU_MAX_MES_PIPES; pipe++)
+               amdgpu_ucode_release(&adev->mes.fw[pipe]);
+
        for (xcc_id = 0; xcc_id < num_xcc; xcc_id++) {
                if (!adev->enable_uni_mes) {
                        amdgpu_bo_free_kernel(&adev->gfx.kiq[xcc_id].ring.mqd_obj,