⬢ DragonFlyBSD Kernel Audit
DF-5131 / fix.diff
← back to finding ↓ download raw
diff -ruN a/sys/dev/drm/radeon/cik.c b/sys/dev/drm/radeon/cik.c
--- a/sys/dev/drm/radeon/cik.c	2026-09-30 04:48:21.819830918 +0000
+++ b/sys/dev/drm/radeon/cik.c	2026-09-30 04:48:21.863830353 +0000
@@ -3692,8 +3692,19 @@
 		return ERR_PTR(r);
 	}
 
-	radeon_sync_resv(rdev, &sync, resv, false);
-	radeon_sync_rings(rdev, &sync, ring->idx);
+	r = radeon_sync_resv(rdev, &sync, resv, false);
+	if (r) {
+		radeon_ring_unlock_undo(rdev, ring);
+		radeon_sync_free(rdev, &sync, NULL);
+		return ERR_PTR(r);
+	}
+
+	r = radeon_sync_rings(rdev, &sync, ring->idx);
+	if (r) {
+		radeon_ring_unlock_undo(rdev, ring);
+		radeon_sync_free(rdev, &sync, NULL);
+		return ERR_PTR(r);
+	}
 
 	for (i = 0; i < num_loops; i++) {
 		cur_size_in_bytes = size_in_bytes;
diff -ruN a/sys/dev/drm/radeon/cik_sdma.c b/sys/dev/drm/radeon/cik_sdma.c
--- a/sys/dev/drm/radeon/cik_sdma.c	2026-09-30 04:48:21.827830815 +0000
+++ b/sys/dev/drm/radeon/cik_sdma.c	2026-09-30 04:48:21.879830146 +0000
@@ -598,8 +598,19 @@
 		return ERR_PTR(r);
 	}
 
-	radeon_sync_resv(rdev, &sync, resv, false);
-	radeon_sync_rings(rdev, &sync, ring->idx);
+	r = radeon_sync_resv(rdev, &sync, resv, false);
+	if (r) {
+		radeon_ring_unlock_undo(rdev, ring);
+		radeon_sync_free(rdev, &sync, NULL);
+		return ERR_PTR(r);
+	}
+
+	r = radeon_sync_rings(rdev, &sync, ring->idx);
+	if (r) {
+		radeon_ring_unlock_undo(rdev, ring);
+		radeon_sync_free(rdev, &sync, NULL);
+		return ERR_PTR(r);
+	}
 
 	for (i = 0; i < num_loops; i++) {
 		cur_size_in_bytes = size_in_bytes;
diff -ruN a/sys/dev/drm/radeon/evergreen_dma.c b/sys/dev/drm/radeon/evergreen_dma.c
--- a/sys/dev/drm/radeon/evergreen_dma.c	2026-09-30 04:48:21.819830918 +0000
+++ b/sys/dev/drm/radeon/evergreen_dma.c	2026-09-30 04:48:21.871830250 +0000
@@ -127,8 +127,19 @@
 		return ERR_PTR(r);
 	}
 
-	radeon_sync_resv(rdev, &sync, resv, false);
-	radeon_sync_rings(rdev, &sync, ring->idx);
+	r = radeon_sync_resv(rdev, &sync, resv, false);
+	if (r) {
+		radeon_ring_unlock_undo(rdev, ring);
+		radeon_sync_free(rdev, &sync, NULL);
+		return ERR_PTR(r);
+	}
+
+	r = radeon_sync_rings(rdev, &sync, ring->idx);
+	if (r) {
+		radeon_ring_unlock_undo(rdev, ring);
+		radeon_sync_free(rdev, &sync, NULL);
+		return ERR_PTR(r);
+	}
 
 	for (i = 0; i < num_loops; i++) {
 		cur_size_in_dw = size_in_dw;
diff -ruN a/sys/dev/drm/radeon/r600.c b/sys/dev/drm/radeon/r600.c
--- a/sys/dev/drm/radeon/r600.c	2026-09-30 04:48:21.815830970 +0000
+++ b/sys/dev/drm/radeon/r600.c	2026-09-30 04:48:21.847830559 +0000
@@ -2994,8 +2994,19 @@
 		return ERR_PTR(r);
 	}
 
-	radeon_sync_resv(rdev, &sync, resv, false);
-	radeon_sync_rings(rdev, &sync, ring->idx);
+	r = radeon_sync_resv(rdev, &sync, resv, false);
+	if (r) {
+		radeon_ring_unlock_undo(rdev, ring);
+		radeon_sync_free(rdev, &sync, NULL);
+		return ERR_PTR(r);
+	}
+
+	r = radeon_sync_rings(rdev, &sync, ring->idx);
+	if (r) {
+		radeon_ring_unlock_undo(rdev, ring);
+		radeon_sync_free(rdev, &sync, NULL);
+		return ERR_PTR(r);
+	}
 
 	radeon_ring_write(ring, PACKET3(PACKET3_SET_CONFIG_REG, 1));
 	radeon_ring_write(ring, (WAIT_UNTIL - PACKET3_SET_CONFIG_REG_OFFSET) >> 2);
diff -ruN a/sys/dev/drm/radeon/radeon_vm.c b/sys/dev/drm/radeon/radeon_vm.c
--- a/sys/dev/drm/radeon/radeon_vm.c	2026-09-30 04:48:21.831830764 +0000
+++ b/sys/dev/drm/radeon/radeon_vm.c	2026-09-30 04:48:21.879830146 +0000
@@ -702,7 +702,11 @@
 	if (ib.length_dw != 0) {
 		radeon_asic_vm_pad_ib(rdev, &ib);
 
-		radeon_sync_resv(rdev, &ib.sync, pd->tbo.resv, true);
+		r = radeon_sync_resv(rdev, &ib.sync, pd->tbo.resv, true);
+		if (r) {
+			radeon_ib_free(rdev, &ib);
+			return r;
+		}
 		WARN_ON(ib.length_dw > ndw);
 		r = radeon_ib_schedule(rdev, &ib, NULL, false);
 		if (r) {
@@ -830,7 +834,9 @@
 		uint64_t pte;
 		int r;
 
-		radeon_sync_resv(rdev, &ib->sync, pt->tbo.resv, true);
+		r = radeon_sync_resv(rdev, &ib->sync, pt->tbo.resv, true);
+		if (r)
+			return r;
 		r = reservation_object_reserve_shared(pt->tbo.resv);
 		if (r)
 			return r;
diff -ruN a/sys/dev/drm/radeon/rv770_dma.c b/sys/dev/drm/radeon/rv770_dma.c
--- a/sys/dev/drm/radeon/rv770_dma.c	2026-09-30 04:48:21.823830867 +0000
+++ b/sys/dev/drm/radeon/rv770_dma.c	2026-09-30 04:48:21.879830146 +0000
@@ -63,8 +63,19 @@
 		return ERR_PTR(r);
 	}
 
-	radeon_sync_resv(rdev, &sync, resv, false);
-	radeon_sync_rings(rdev, &sync, ring->idx);
+	r = radeon_sync_resv(rdev, &sync, resv, false);
+	if (r) {
+		radeon_ring_unlock_undo(rdev, ring);
+		radeon_sync_free(rdev, &sync, NULL);
+		return ERR_PTR(r);
+	}
+
+	r = radeon_sync_rings(rdev, &sync, ring->idx);
+	if (r) {
+		radeon_ring_unlock_undo(rdev, ring);
+		radeon_sync_free(rdev, &sync, NULL);
+		return ERR_PTR(r);
+	}
 
 	for (i = 0; i < num_loops; i++) {
 		cur_size_in_dw = size_in_dw;