From: Geoffrey McRae <geoffrey.mcrae@amd.com>
Date: Sun, 28 Jun 2026 06:17:01 +0000 (+1000)
Subject: drm/amdgpu/mes: Add NULL check for mes_hung_db_array allocation
X-Git-Url: http://git.hungrycats.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f3f622b43edc86a4ae00f521789a5d24bb71a761;p=linux

drm/amdgpu/mes: Add NULL check for mes_hung_db_array allocation

kcalloc but does not check for failure. If the allocation fails, the
pointer remains NULL but the function returns success. Subsequent code
using this buffer will dereference a NULL pointer, causing a kernel
oops. Add a check to return -ENOMEM if the allocation fails.

Signed-off-by: Geoffrey McRae <geoffrey.mcrae@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
---

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c
index 6c0dde3786e34..261ddc19c840b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c
@@ -250,11 +250,16 @@ int amdgpu_mes_init(struct amdgpu_device *adev)
 				goto error_doorbell;
 			}
 		}
-	}
 
-	adev->gfx.mec.mes_hung_db_array =
-		kcalloc(amdgpu_mes_get_hung_queue_db_array_size(adev),
-			sizeof(u32), GFP_KERNEL);
+		adev->gfx.mec.mes_hung_db_array =
+			kcalloc(amdgpu_mes_get_hung_queue_db_array_size(adev),
+				sizeof(u32), GFP_KERNEL);
+
+		if (!adev->gfx.mec.mes_hung_db_array) {
+			r = -ENOMEM;
+			goto error_doorbell;
+		}
+	}
 
 	return 0;