From nobody Tue Sep 29 10:32:43 2026 Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9AFB237E2F7 for ; Sat, 8 Aug 2026 22:29:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.41 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786228192; cv=none; b=GaKweav8cbs9Zc53cY+YkZ6H1wd5RUWdhkFN9Zg+LqEv3Eq2wgGvoPqQap2F88mOs5XT1wi2+9TGWDOelaM6kovU+2Bkl2w4VM6ShQ/Dqm/9JrjW/hPlsq934UaLH3aMYpeVXqSAZxoHhAyT0rWlNb2P+VcR9KdBJmkECi1Dbw0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786228192; c=relaxed/simple; bh=aDj5aLG7NStNslfYhTIl3YYv6XZgFNUFXK8u7qYzlf0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=b77FMEcgPl1/kiRe2qlnhFVuDvBQPKrzENAJgB87eHYkqDfh6mDv2aN0Wf8iP0SEN+4GphYvzi4K8Mc3jb8Hfn96raiYvSvJUSR2Sa+0gQ1NtYWbihhaKyYgsasLRRei2fqvYjFnLMArrBUZdemyHRXalL7AQ8VfuyZ61Cq5C9g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ZouUadkc; arc=none smtp.client-ip=209.85.216.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ZouUadkc" Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-38f0f132f56so2450719a91.0 for ; Sat, 08 Aug 2026 15:29:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786228191; x=1786832991; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=A3BeIAtfJ2/omVu82I5VMk45uIa8CTiHrIT/44X40ds=; b=ZouUadkcZ1hhwk7+O2lLUlXpaellPvB7zsIGd9+1xZs8jOLShzemZhfL19TDK8CdNE 1IlI1ohgjTUd8ja319TZqnsKE2hCICGEswyiYStkY/hNcszxTK9L7BM2Ybwlg8woQFcR PJNB982tcr90R3D6EUMWpN+mofJDENlOOBVLVjxYn3UgCMOqQmdR2EbZjdxmh1qEUYYN RXTT3KvAVANl+4AltXNvDE7sEUrp3AeBf6UYlEILOSkAUHjYdzRthc9ndMukwp+wfSWc 8qbvUNvoXZEPB4CwPR2pkRNAUqOT9K3qV6QgyZyzwSN8t/19JVACHJv25sR/vdytf5n1 BoCg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786228191; x=1786832991; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=A3BeIAtfJ2/omVu82I5VMk45uIa8CTiHrIT/44X40ds=; b=Zyy90rLtqOkX6KYBpZGcy0us9S7B1AbdQKmQoquxhyoA+Sq8of9rUruAZNYPEDr/rY j5Xc5yUObTz6Y5bdgIk1+zXCvJmSIQMUA0eHFUmqMr/RWoHRzWRhCyzNU1DJijOUAV7Q LAqZdo/RqRd/ye/8/ipHLaAbMG4kk09rNyOurQSmiFbVbMf16p6oYYAXNNlw2rlOj376 JelxF1gI3nilIt8nCETbbro79O0UiFqhb+AiMgPcUkEYstlCQc2A2Y+8oMeNj0M/sko+ sZWNL49RP2DJ4YC2UMBxbynPYICS8Ovx0sQuj1ldjYx6uUavtk3yI8X1U8w1+xbOUjvN AMIw== X-Forwarded-Encrypted: i=1; AHgh+RqkotW1YEbM+HrdwhOSTYJWHN1vODReCDlrc/NAPv3bwa5uu55ZLb0e64xA7sTmuI7azjJO+jnZ0LoN75M=@vger.kernel.org X-Gm-Message-State: AOJu0YzZPYyi3SjvNRDDLBk7W7FqofHrLnrM1+0hlIleUsk0Olrv/BU/ CNUSBLqmHN9SKsn97D7lDaZTFZHfQULDs/ikmgN0Q8y0B+0QwpPPXHh+ X-Gm-Gg: AR+sD11s/31D2glDy7DkXwsaT6iO+ZfJ0ueyYXvBbJBBkn+DF5dZMsF+DmxmQ/fOYBd nnfDQH8hSUcS3GRBkZJllM6t5021EAOn0zlI6EKAmFek/XCUkVgBaV1iZhgZibom95jz7a9ii7d L22L6hyctH0EX+TQPlDoEPZ8JKSVNC7UmOc+ACagWK943iR1BQgR8RTYgRkB0p16yNwhi2WFSyU R3bbtGysfE2ol1P+Bw0Asr9i7wI3rgEPS2a8T3ou4FKXkNRGdgGEn3d4ydMJtJitozt514x0d8N 31wYaTs3YBkBvLsy9mVWv6uV8biXWOfKe+mxTs/V11Ky+dBLD8Cb9UsHAG2CB328FZl4kX+w9D5 0yOueTbwNu2RGIFy5IspkGuttuGfKRofDaSsQXZhsn65d7Zwl9BtrWfdS8tuCNU3t6gWEwC6C1Z ckp5A2i/9kOxypM7nAVEIE37iXATJnW5++fX/uHo8cXLhjJFPd14KGKPeE1ni3yN6/ClY+9Mu6K 1RhY3OiGSE= X-Received: by 2002:a17:90a:dfcf:b0:38f:cfe2:fd3a with SMTP id 98e67ed59e1d1-392847505bfmr4213335a91.15.1786228190844; Sat, 08 Aug 2026 15:29:50 -0700 (PDT) Received: from localhost.localdomain ([103.178.204.72]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-315beb877b4sm27463910eec.19.2026.08.08.15.29.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 08 Aug 2026 15:29:50 -0700 (PDT) From: Sreeraj S Kurup To: alexander.deucher@amd.com, christian.koenig@amd.com Cc: amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, airlied@gmail.com, simona@ffwll.ch, Sreeraj S Kurup Subject: [PATCH v2 1/5] drm/amdgpu/aca: Fix race condition and UAF in error cache logging Date: Sat, 8 Aug 2026 22:27:38 +0000 Message-ID: <20260808222742.2859-2-sreekuttan2156239@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260808222742.2859-1-sreekuttan2156239@gmail.com> References: <20260808222742.2859-1-sreekuttan2156239@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In aca_error_cache_log_bank_error(), find_bank_error() released aerr->lock prior to returning bank_error. This created a time-of-check to time-of-use (TOCTOU) race window where a concurrent caller of aca_log_aca_error() could acquire aerr->lock and free the bank_error node via aca_bank_error_remove(). When execution returned to aca_error_cache_log_bank_error(), incrementing bank_error->count resulted in a Use-After-Free and potential kernel memory corruption. Additionally, bank_error->count was updated outside mutex lock protection. Fix this by acquiring aerr->lock at the start of aca_error_cache_log_bank_error() and holding it continuously across lookup, creation, and counter updates, while removing redundant internal lock acquisitions in helper functions. Signed-off-by: Sreeraj S Kurup --- drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c b/drivers/gpu/drm/amd/= amdgpu/amdgpu_aca.c index db7858fe0c3d..d0d473082431 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c @@ -237,10 +237,8 @@ static struct aca_bank_error *new_bank_error(struct ac= a_error *aerr, struct aca_ INIT_LIST_HEAD(&bank_error->node); memcpy(&bank_error->info, info, sizeof(*info)); =20 - mutex_lock(&aerr->lock); list_add_tail(&bank_error->node, &aerr->list); aerr->nr_errors++; - mutex_unlock(&aerr->lock); =20 return bank_error; } @@ -249,22 +247,16 @@ static struct aca_bank_error *find_bank_error(struct = aca_error *aerr, struct aca { struct aca_bank_error *bank_error =3D NULL; struct aca_bank_info *tmp_info; - bool found =3D false; =20 - mutex_lock(&aerr->lock); list_for_each_entry(bank_error, &aerr->list, node) { tmp_info =3D &bank_error->info; if (tmp_info->socket_id =3D=3D info->socket_id && tmp_info->die_id =3D=3D info->die_id) { - found =3D true; - goto out_unlock; + return bank_error; } } =20 -out_unlock: - mutex_unlock(&aerr->lock); - - return found ? bank_error : NULL; + return NULL; } =20 static void aca_bank_error_remove(struct aca_error *aerr, struct aca_bank_= error *bank_error) @@ -306,11 +298,15 @@ int aca_error_cache_log_bank_error(struct aca_handle = *handle, struct aca_bank_in return 0; =20 aerr =3D &error_cache->errors[type]; + mutex_lock(&aerr->lock); bank_error =3D get_bank_error(aerr, info); - if (!bank_error) + if (!bank_error) { + mutex_unlock(&aerr->lock); return -ENOMEM; + } =20 bank_error->count +=3D count; + mutex_unlock(&aerr->lock); =20 return 0; } --=20 2.54.0 From nobody Tue Sep 29 10:32:43 2026 Received: from mail-pg1-f177.google.com (mail-pg1-f177.google.com [209.85.215.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 40C7C37E2F7 for ; Sat, 8 Aug 2026 22:30:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.177 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786228205; cv=none; b=oMZKzaPWM0T3rDu6oDZyWuG8o5daAWf9Mov8FvUxwjJ8U/2gg8e5c4GNRrZIU0gMcM7L9Wz/YWClryAkAtjSI6FxD8P6T7oMPZKg6F4IsFfdcQbCPA+azVlLzR4bKBKJZzINEOWOwLwDvKX62m2Lye4KybMqMwreEmxL7WmowF0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786228205; c=relaxed/simple; bh=weRrChkTJgmtJ7e7uWxoKD+8+f+Z6NRdCPQ7Z7d8o5s=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=MqqwNm8C+A/R4xZzgpeU+L/iqvlsy3mT3jExa9mmgaazvpaqaecIxuTRDfqlCcG8whSbda6JpANBI6XYMWTgK0kNXYVVOjKZgRdtleelSFfmAJX/eDyPj95JbLfqt0TaEHbp6Yq/uHSi7nzY6WP2/7TsZ5D3plZ0YF7tn80V51Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=eYITir/i; arc=none smtp.client-ip=209.85.215.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="eYITir/i" Received: by mail-pg1-f177.google.com with SMTP id 41be03b00d2f7-cbb8b54fcf8so466930a12.0 for ; Sat, 08 Aug 2026 15:30:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786228203; x=1786833003; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=deoqn41jn4hqxaXBU0LER8gLC0cAyHmrQg56bcVPpQA=; b=eYITir/iG1b9PiqsxTMZ6vDeGdt22F3FfaXvzan+ifS6pVKs6TaKExDCOkVQtadfGL SEtyugrdHS3Mz3JupcmlrU9C8D3/p6WZv8ZLD21JEBRO75xv1iIwWPa+VgdF6BJxEXFi W+b1xZyOPNmSCF9uPmxaHptWaSo2V57p2YwTK4ZB/hTRFkoqx9LXLwuaOF7V5lBjPDYL IBT9qJ1s5c+gghe+gF8M5vvd98+S3sIn+AAwC+zXLhC4t3IwJJunqp5Gjb06ZKlsNPd9 BfGRE8tPfcL6O95PBqPBRlk5iW4A0NyUtYgY2/SmgtN/xgiYf6lyA9S1hRCfSYJnweE4 +P/A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786228203; x=1786833003; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=deoqn41jn4hqxaXBU0LER8gLC0cAyHmrQg56bcVPpQA=; b=AYwDLEXckZuzW6loFnYwUsPnzWyPmZl+6H19LvRN1usKrjOv1ERLLAdanXvTyqr55m lukBZgUyANzYb+1XcDqs4bNUWvH3eQcqWstZsS18/kCWjq/ixQQ7ugzE+rS8E6+yHESY OJdab4GkaP1QJTzsq9U6iWlUIn1DWt+tzIQO9c03yZ4Sqg7TekGDEnJXGt5ycoU2jier sIvm/oUIZXb8rYHfdvVqkQGr3c79QM46Lkh9Yfmz0os9Cdh5la3KtkqWe8nBLyciM1ch IdOsLQaTL19WgYtzWz0pk/9x7hpCkmTu1OpcKF9LCNzEbOIJtLZ0u1VExnlv7LrFj808 N1Qw== X-Forwarded-Encrypted: i=1; AHgh+RrnuSN5GYzmtoGN2rNk6enJLBnEd5hDp174izfRCOghAhmpPr0oZAKtLIUUQlOerEBuDvCdiR58UdcCwNI=@vger.kernel.org X-Gm-Message-State: AOJu0YxeYkgQqA9PClpWwdTR4IfvFk4IdTN+yy9ViXQKNvyb8N9t1G78 ieolN+7vGeJMKq9SEI2feU9mhYDjDfMyuMoGEQQTsNnrmzatL+VjPGBH X-Gm-Gg: AR+sD12A3RD9Spm/h2O9w9lkEQShUd/3w2xaj+xvfHSRKEMJHqeg7NzPzYWoynsTK/X B8OhaO0adHkwo2sofIS4yJ145naSvWOtDzgeRu/fcmF5DpeXKJfdBmZpbQPjKLsDBmdD/cuKXLi tWkjEqEkvpVanO+nX+VpeEgydTUrmm8W8OrDHSAUnQogvlN+ali48mM6xSGzZay+woSt/Tu7UZA toDcs6q/AdQy13352742xikl0agC1DlZXXPMLC+on6Y1H0V5f/xz1GazOSUkUZMc2Ye7jdyrgGG ghLMMiEseTO2mr/wqKSYkTn/3Xlvc4X+Uf23geUEUqNON35cARr/p5UyF/fOFVgRXg4hdUO3OkM BE7N8aozfqKUgc6xpOiwD0/ggf7yrxlCnUp3qZ1zCRdffHCUraEgxUZUcyaJj6UIS1RgCe/VUsl 5Qc7UJbR4XuGIaAY7a1jeeNy1eVeSePQPH3g2IX2B9M+zf3LKbLsfDiFSv7PbWTGq7zm9/eCsd7 804ZU4Zro0= X-Received: by 2002:a05:6a21:6e0c:b0:3bf:c223:4640 with SMTP id adf61e73a8af0-3cb85f4e199mr40663547637.32.1786228203504; Sat, 08 Aug 2026 15:30:03 -0700 (PDT) Received: from localhost.localdomain ([103.178.204.72]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-315beb877b4sm27463910eec.19.2026.08.08.15.30.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 08 Aug 2026 15:30:03 -0700 (PDT) From: Sreeraj S Kurup To: alexander.deucher@amd.com, christian.koenig@amd.com Cc: amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, airlied@gmail.com, simona@ffwll.ch, Sreeraj S Kurup Subject: [PATCH v2 2/5] drm/amdgpu/aca: Add upper bounds check in aca_bank_hwip_is_matched Date: Sat, 8 Aug 2026 22:27:39 +0000 Message-ID: <20260808222742.2859-3-sreekuttan2156239@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260808222742.2859-1-sreekuttan2156239@gmail.com> References: <20260808222742.2859-1-sreekuttan2156239@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In aca_bank_hwip_is_matched(), the 'type' parameter is used directly as an array index into aca_hwid_mcatypes[]. The function previously checked whether 'type' was equal to ACA_HWIP_TYPE_UNKNOW, but did not validate whether 'type' was less than ACA_HWIP_TYPE_COUNT or negative. If an invalid or out-of-bounds enum value is passed, an out-of-bounds memory read occurs on the aca_hwid_mcatypes array. Fix this by validating that 'type' is strictly greater than ACA_HWIP_TYPE_UNKNOW and less than ACA_HWIP_TYPE_COUNT before performing the array lookup. Signed-off-by: Sreeraj S Kurup --- drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c b/drivers/gpu/drm/amd/= amdgpu/amdgpu_aca.c index d0d473082431..c76664af9902 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c @@ -138,7 +138,7 @@ static bool aca_bank_hwip_is_matched(struct aca_bank *b= ank, enum aca_hwip_type t int hwid, mcatype; u64 ipid; =20 - if (!bank || type =3D=3D ACA_HWIP_TYPE_UNKNOW) + if (!bank || type <=3D ACA_HWIP_TYPE_UNKNOW || type >=3D ACA_HWIP_TYPE_CO= UNT) return false; =20 hwip =3D &aca_hwid_mcatypes[type]; --=20 2.54.0 From nobody Tue Sep 29 10:32:43 2026 Received: from mail-pg1-f178.google.com (mail-pg1-f178.google.com [209.85.215.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C8B8B37F00F for ; Sat, 8 Aug 2026 22:30:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.178 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786228214; cv=none; b=ZaoS4U/nsDZPSa0ZEElDmWjHOOOpbDNYNaGQfRpOkmwJ1/QDRyDdDDhHewky/Ui4NxyKVHvZbs/XbboEfPt4UJRGzXnak4qJZkFtA58iYtEML7rmtflTJT6NqelWury3IGCQ9/qiV41/B9TGYZaJPMgDLwfm8L2Xmqp5n13PUDo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786228214; c=relaxed/simple; bh=G6nrGKFQZEd0KfnZiDghPw1/bIkjjh0wRidFwwxLzTM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ozzq7retaYH6if62x3O0XrOBzVvbbyyIXpPscEdO6U3qa+L6AbikVqusWQZ3RCWY7+MloL2HKIjxHaDBnkeBm3dOvHkTXUEWDVJPrGtnAMHW5IEC+0cSdS7B4zruCt3fbW8wYaE7GVXAZko2mdMG5gDRGJO3QwEYbNayzG64HQY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=G4m3sjDZ; arc=none smtp.client-ip=209.85.215.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="G4m3sjDZ" Received: by mail-pg1-f178.google.com with SMTP id 41be03b00d2f7-ca7c1176317so519051a12.1 for ; Sat, 08 Aug 2026 15:30:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786228211; x=1786833011; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=S+lUmXf0M1/AoHp7ybgP/EVeQH1GTrMXgFQpOQU1h9c=; b=G4m3sjDZ6mS4mkiHtm0fRc31yKrjLzvlNEM+gTvfT++fxCrKD5+AbXlydoiRcV9Vtt AdaKa7CeSdc+bzDG6jasqPmreG/DXtRnGt1v2f4qNBxZPGGuLcXEtT7W83e+wK6ooekw CpkQnXMjg1AUHnew0gyC1gNjUo5XJ+rhJ/jQX7vbVJboPtM/qJFtaBjjVrgkwcqe5s8I LouRLh2OIeyDwwFVnjzulhoca4wRcQ5f/ijs3NECdB0+H4tGQVckJ0Zs4x3BdR8XlBMF 0LX8udQSvfWLEQkA8eXrefjuTI2uzBkewX+JWXLq0tFRrNaWOqB5X94pV2aV6SkYW0ie V7sQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786228211; x=1786833011; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=S+lUmXf0M1/AoHp7ybgP/EVeQH1GTrMXgFQpOQU1h9c=; b=qbcdIaQvkZ1tDKH6bSr7wiHaWGgfBb23Hz36Zg1TPQgnpjnSu2vA4V4NByC/E+2KVp L2ofqF+M0zfdVvrrzi7BdRqLXVB4iM8H86AxV4QFyevHbAnoMH+wVyGtCAgbd1NmEndu /TTPjrqYLkyM5/xu7D38uyGx+UVJrr6NA0fV++8HRAo8Q8Dv/LP8s+xiYaqOvxb2JnR+ Xns5jmfC7Y1MfgNmoOFYOivD+vZ7ZNGMjBscZ8D6b4l6ws5q+gon0egPu/H8sAJR/NBe zWUcryoLK4CF7aiSpK0293aNwL+SDO/1Gg+4bAeF+2bcUDeddqdHjDVvBCXFwzf8xNDX qaFQ== X-Forwarded-Encrypted: i=1; AHgh+RpL5/NVfswNAAah2vtcKHHJBx3OqdkV1RzXzR0wmTxXwsETwuDNEVyOa0tWmUqpNnPevJzyfPuQeO6Y0Sg=@vger.kernel.org X-Gm-Message-State: AOJu0YzFtMSQ3pvT9AdXOPHPPKOoH1aS4cIou13+6j97Y9R8/0GF9ovg LGF7aQx9ldiW+7LoIkKAjaeL9u+O1f4o8dli93cwZfuHWAnWyAsET5st X-Gm-Gg: AR+sD12Kh3vsUXK02QJsXH15mMQeSu0Qe8ew4ZMzEyg/hYIvvDIx83RA4dnQUhMMZoN Fzx+YhLzatpkuVnVy5PwHtSP4+cMyw75HKSDro3F3xnzTxarYtnY5dpvWsvIB4zyc/aVetEYKIQ 30z33uTimpYCqSYje8SssI1JErtjN3kmiMMbX5geDhVtO+maP0lP9D+/+/NV4JL9onTTHqKAl7v eIJi5WbobDXlvxPWdqDowKSFgDt+Qb7I+3Gxk49UCn2qOq+qx/kLb/06Oqjo/5brek4GiD+Ebgg +mkHr5KfKat6ygprMSSyNiFtyLcuTsF/rNkehTGpv15NhKYbv+tLgk0rjiaQj2u4Dr4+w5YZeVY pcfkx/fV52S6Ns3U4F18dsNXJoFoQCF5KHrSU2JojLv2VnZEkvc2yUZB5AMPuLUNxqbLV23t964 6QKUjsWUZNZsDoLKBrZoUveOo3uzswRGrdd2EgwUZX0cX2pYSvaefU/jC/4OeQRZIwZBD+VlCOm INGnYajonA= X-Received: by 2002:a05:6a20:4309:b0:3c4:48da:8102 with SMTP id adf61e73a8af0-3cbce930129mr10090468637.29.1786228210822; Sat, 08 Aug 2026 15:30:10 -0700 (PDT) Received: from localhost.localdomain ([103.178.204.72]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-315beb877b4sm27463910eec.19.2026.08.08.15.30.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 08 Aug 2026 15:30:10 -0700 (PDT) From: Sreeraj S Kurup To: alexander.deucher@amd.com, christian.koenig@amd.com Cc: amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, airlied@gmail.com, simona@ffwll.ch, Sreeraj S Kurup Subject: [PATCH v2 3/5] drm/amdgpu/aca: Fix inverted validation logic and handle cleanup Date: Sat, 8 Aug 2026 22:27:40 +0000 Message-ID: <20260808222742.2859-4-sreekuttan2156239@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260808222742.2859-1-sreekuttan2156239@gmail.com> References: <20260808222742.2859-1-sreekuttan2156239@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" aca_handle_is_valid() returned false if !list_empty(&handle->node) evaluated to true. Because active registered handles have non-empty nodes in the handle list, valid handles evaluated as invalid. Consequently, amdgpu_aca_get_error_data() returned -EOPNOTSUPP whenever aca_handle_is_valid() evaluated to true. Fix the logic in aca_handle_is_valid() to verify that the handle is non-NULL, contains a valid mask, and is currently registered in the list. Negate the check in amdgpu_aca_get_error_data() so valid handles are processed properly. Additionally, update remove_aca_handle() to use list_del_init() instead of list_del(). Standard list_del() leaves node pointers poisoned, which causes !list_empty() in aca_handle_is_valid() to evaluate to true for removed handles, leading to a potential use-after-free during device teardown. Signed-off-by: Sreeraj S Kurup --- drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c b/drivers/gpu/drm/amd/= amdgpu/amdgpu_aca.c index c76664af9902..b4c1438a56d8 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c @@ -586,10 +586,7 @@ static int __aca_get_error_data(struct amdgpu_device *= adev, struct aca_handle *h =20 static bool aca_handle_is_valid(struct aca_handle *handle) { - if (!handle->mask || !list_empty(&handle->node)) - return false; - - return true; + return handle && handle->mask && !list_empty(&handle->node); } =20 int amdgpu_aca_get_error_data(struct amdgpu_device *adev, struct aca_handl= e *handle, @@ -599,7 +596,7 @@ int amdgpu_aca_get_error_data(struct amdgpu_device *ade= v, struct aca_handle *han if (!handle || !err_data) return -EINVAL; =20 - if (aca_handle_is_valid(handle)) + if (!aca_handle_is_valid(handle)) return -EOPNOTSUPP; =20 if ((type < 0) || (!(BIT(type) & handle->mask))) @@ -717,7 +714,7 @@ static void remove_aca_handle(struct aca_handle *handle) struct aca_handle_manager *mgr =3D handle->mgr; =20 aca_fini_error_cache(handle); - list_del(&handle->node); + list_del_init(&handle->node); mgr->nr_handles--; } =20 --=20 2.54.0 From nobody Tue Sep 29 10:32:43 2026 Received: from mail-pg1-f173.google.com (mail-pg1-f173.google.com [209.85.215.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 41505380FE5 for ; Sat, 8 Aug 2026 22:30:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.173 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786228220; cv=none; b=C+yovhqMCkWhoyU6OTHLTgTBxkU/z9Keq7ncPVfqke4C2trDOvLtIQcimFwMTdpw1aB2miEHMaRyd7HX1sMs4/uUJUQU/Z+1hbBh8naheO3Llr2dtWw72BPvpKbYF3hoIlfHk05Epn0TfXs1HbwioVyRMcnn6mD3KsVblp306vk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786228220; c=relaxed/simple; bh=HM4J9zsidGvluJCT2OWyo8y7Tr5Ocekq/MLSFBhGOTk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=hsGh+ldtIWB91nzbuSUznHVcJ0BvmxK+uoXich/l2Yz3JceOgWk2A2Et3FwFp6UH72CKyR2d/5j00XgN19IuBK1+O4/rQlV9/P3R9GHFpJLvdFSJJlbe9WEYaaQ0oatv7ujQ4FrOFiUhGIpoDtG0ac5j1/Zbz1GlHRk36ek18UQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=WpJs3JKX; arc=none smtp.client-ip=209.85.215.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="WpJs3JKX" Received: by mail-pg1-f173.google.com with SMTP id 41be03b00d2f7-c99eaa1f020so716534a12.2 for ; Sat, 08 Aug 2026 15:30:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786228217; x=1786833017; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=donWOa9YU7cxTUOyT0FxOO2TlG0hwlAfCOqayTIhbbE=; b=WpJs3JKXlsEC7vJXzoBZunYA/FnZPa6dyDVcy7uSO2PyyoA+PYbeFEvOUq+jH2+shW orn41kolEUCnmDj5Snzo1aX16KRugF/XSiDBOvXSSn/1jIP4dPz5Y9aR9glcOoeaVISe RswdCBfvtpdgzMU1s9JvGNEnVvWdR61eOJX0yI0uRLB7AvHTZnmt2/iotkPKCjsCQC7A 7rI4OsuiTuWn5BvgQZzB8zbK1A3GPslv27ufbVvZXsTjJOrx9lbLyD2t2gQ9q5ajbTi8 wyuf1a5afxNIO7+mZ1HX204Cy22MpTv0XIPqqDN5hpGSyBjOuMmUAezgagDT5T2WU7uu K6ZQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786228217; x=1786833017; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=donWOa9YU7cxTUOyT0FxOO2TlG0hwlAfCOqayTIhbbE=; b=ihv98thUGUvfLOmhPiHBDqybXhDuTPf9dcgVxcjBIS2bz+V6QWQhmnm0L0wNC62CWN APpVvrjoEAwS9FpVUSl3NRDs7T88n8DkjbF0bBIMIOKbV+O1qcJa0Bn5B2ZKCjmpEKss Hk84ukHjQWPBCjFCgYo8Ph+sF4lznfRlJct2FTLOBNz6uQtctZB4SNWbtIugZfm9iQds 9M3IzvNkzSXFKYTyFJtfeVshIstz5YNhGLZdKYqT9YG5maTBRw6mzhw80pGK1qQqONl2 HtDS7hyDWIxLM8Mqyk383Tx7zKa4WRlqqPjjPvf8aFnjqQFn97j53XFuqQaGDhCwRyaZ cNgg== X-Forwarded-Encrypted: i=1; AHgh+RoRsP4nFGoBpCLpu9IGG5JlKd9990+m76YnKMbTuQFHMVzQT256dfrIPU536rGwGRYnDxZoUqqqu6CfC34=@vger.kernel.org X-Gm-Message-State: AOJu0YytDMD9YdOktMr/HTwu5Ahr28b9AobaQqicOudHRUXHJAcyvFgg Ea/KBgtUbMaoFrj3kv5bBzN2THliMq/7demHnkxFeQMgAjjWI2yDBkyx X-Gm-Gg: AR+sD11jKnJcgimuoB6yiLw6HasLLV3eO8Z7gpyQyjw+tO0nr/+GZ5e6DNEQLXwVrk3 o0re8wxp/pwryVvRgA3wdNE3BuuhBIgZ5WDnZLDO7hFMwcplbzEXF16DQ0UHlPBZ95S8dulGr9x K5iW1niLb/8CJyGeXxliamtAXzIGTqGty6x8sKI+BekFAsIXKH6dxNkty8IDPuEmEuL/6DT5f32 o5Kjt+3GEbbf008p8asbX0IrXSIG6tyFrOcyOHcBJOcRC1eQVro5IMEEELydCZSYLQIs6q77yTV Lcb4ekfkUEfN/jA2YJDAaWK3wgFDXni+z79/g/zF7s/4gnz+/7taUMXDyDOzc1C4i1ICnlHbfQr 1CSIaKurYhvHBWwUZeqDX5ab9i1ggJNSlbgSR9pD1Trj1oKj1ltY2mVbX5IyQRfWZDUa2iWlLH4 kLYiSgi/5E4Tg2TxGZ8AerRaWC5AbhERZ4noa+WQqZS1QV4kHJpYCet/aXO3z0y+PLwS4CVwqj/ 6Bpoa0eW0voRe1atuVsGw== X-Received: by 2002:a05:6a21:6b16:b0:3bf:b9de:8570 with SMTP id adf61e73a8af0-3cbc03b55demr16594991637.19.1786228216955; Sat, 08 Aug 2026 15:30:16 -0700 (PDT) Received: from localhost.localdomain ([103.178.204.72]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-315beb877b4sm27463910eec.19.2026.08.08.15.30.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 08 Aug 2026 15:30:16 -0700 (PDT) From: Sreeraj S Kurup To: alexander.deucher@amd.com, christian.koenig@amd.com Cc: amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, airlied@gmail.com, simona@ffwll.ch, Sreeraj S Kurup Subject: [PATCH v2 4/5] drm/amdgpu/aca: Add missing NULL check for banks parameter in aca_banks_add_bank Date: Sat, 8 Aug 2026 22:27:41 +0000 Message-ID: <20260808222742.2859-5-sreekuttan2156239@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260808222742.2859-1-sreekuttan2156239@gmail.com> References: <20260808222742.2859-1-sreekuttan2156239@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" aca_banks_add_bank() verified that the 'bank' parameter was non-NULL, but passed 'banks' directly into list_add_tail(&node->node, &banks->list) and incremented 'banks->nr_banks' without validating whether 'banks' was NULL. Add a NULL check for 'banks' to prevent a kernel NULL pointer dereference if an invalid pointer is passed by a caller. Signed-off-by: Sreeraj S Kurup --- drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c b/drivers/gpu/drm/amd/= amdgpu/amdgpu_aca.c index b4c1438a56d8..f22b58c559b6 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c @@ -49,7 +49,7 @@ static int aca_banks_add_bank(struct aca_banks *banks, st= ruct aca_bank *bank) { struct aca_bank_node *node; =20 - if (!bank) + if (!banks || !bank) return -EINVAL; =20 node =3D kvzalloc_obj(*node); --=20 2.54.0 From nobody Tue Sep 29 10:32:43 2026 Received: from mail-pg1-f175.google.com (mail-pg1-f175.google.com [209.85.215.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 49724346FB5 for ; Sat, 8 Aug 2026 22:30:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.175 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786228226; cv=none; b=HT7l5sk7+YJTDDG+v6Ir61aY/68CYJtbv2l6Oa1uFNxs82tO8iokD9wjjmJAIRgOJvNT1pyYMNIc0zrETBaWncTmTo0N6W90hb5gr66ORee/AhcrHTq7QxAQWQXj21qb/GLH5opzIWbTQBtjMPp1WI9Fk1qogvuaMykti3mlUyo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786228226; c=relaxed/simple; bh=9Jt1mIgolDNfcXhDQkkei6R3AnCL7GTON47HaNYWiog=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Zd1lcZzFLfiWp0e4f9Wtjf8XiQWwRJNDLp7FOiHueVhqhp8sNQ4Ik67Ho+Hi6lyv9E/K+rFcqP2MW8uzInxHAyZZWe5rwM9ujCPjrrtNQSxW2SMNhqo6oII0+2GpQcsoPUz6OdfaSobXtRA9KtHAMzm2dNyBZnc/24KdXcUEjIM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=qoq3T+ZJ; arc=none smtp.client-ip=209.85.215.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="qoq3T+ZJ" Received: by mail-pg1-f175.google.com with SMTP id 41be03b00d2f7-c9e7391839cso645783a12.0 for ; Sat, 08 Aug 2026 15:30:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786228224; x=1786833024; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=0T8hsbR8l/QSpKtJo+gqmSKNs2cFgYd9YKdYEYcvNTs=; b=qoq3T+ZJKqk66hYannPOinux3N8T9b0Gz3ZHzQgO9MhLoo45pFFBx19J5lO1YUQkzE yrtw6T7E8VhDTWiQZkIvJcaiPdHvjB5yYsg1Zs/YsZLqWPC5Efq/GgI/lrks/BW2CEon dIc7n4a0i30+l3mnh5+cyP+S96aNhRbpHjTPJfzD+VN9+q235efD+SaDcAlq/D6VdxRZ k3bjVL09wPwZLSMjZcJUvVxxW+5Gf/VsckUFLcpAXpAjm8U+CEqysSeeeUR6b4OazVYd 5Mxg5aW+AS+oknzBxeTN6NVxTdaORRtJEyDlQTnQtkP3ft5qPHjE0W0mnqW/++OSYsVq NSRw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786228224; x=1786833024; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=0T8hsbR8l/QSpKtJo+gqmSKNs2cFgYd9YKdYEYcvNTs=; b=i8kIqzLl2DvWoFwvjA/sG06759QcZJBOQrQ9oPs3K1L0w85xyjKFionX02hhIKX73T A/B8fpMgUnOc8dpCu1MgU7GjhBZv2dtCF3PC3aPfxCQpMI8qRP+NMn/mH7UTxCZnbWuJ z/cBjUrAvXzmJYHgs21Isv+k4SJyr1RVH/uzbVeuIA2x5jce1a4QS0iVbgyUzD5E0Kfz RpdJCXlb/PjJD37E1hmZR7iOUZwroo3A3VL+9m71bHvnO7HkY8Ls0acZn9LOSYwE9FxJ RP2qEA8hmii9J1K1RGeuLsBmv5NItOZSOQNLXZx5Pa5L8CvcdJnR+8f4JvEyXB6Wi1pH U+4Q== X-Forwarded-Encrypted: i=1; AHgh+RoSVxAjivxe1svT+0q+2ezEgQ7jYOTPnLQMhx1JejiIkLvFmoRzkJZGpsWsWgs1YZW9G6o2xsD0iyXYGgw=@vger.kernel.org X-Gm-Message-State: AOJu0YxXJQVL3kUDTbJ74Znqzx48MumY5N0bcTntn7A/dXprMVOzqNDP LCJ9r6fWLgz0cAD+Jw1TYrmK529TjWM17OWwP3zrVgnl9ZIIBuQp9UcX X-Gm-Gg: AR+sD11xMFVWAjLguNylZeXnppJJJi9uXKtDeEgQ4WcQiiP21GwwuaSg7Xgyn1U9wVv /7KX8AhdJrnqETXIcw9cHAS/jXQsCt/L87uS4qsZcwwGghpARnBYhQG40IELeLoxA1vsVhgfcgE fTJOlfQV8wDberHiDdqQ854eXN7gauAI9GURC0KxIYO6i9d/rXEjSzmwRGfel1Nk2xlK+7L71OX i/TUXsbhVjD4Cv12ZXBeTwZlbbJJnOe+V+tixZ5jINVwddfmsKoIBy/apdEXPdJxepz1aMrlB8m lnoRFkdhkjmg4Iw0fbxGasBUF3gb/UPBHY7zgMMcvwZEJDXlItt5MGJH33Cg/XKOVNj+Cfg5+2F nNIBviecU0U/PRsrsZRE/1pKjc7pOV/c5Dyi3qTGn+KyHD1zOfYGgbl1w4IuTOBkig2fUeLEFpa 2Sv/52Ve+u29O0X/mClgpP5GSXTX9UHYe8pWc902e9s42CcUKKusW4Lk/AzpFIeE7gSxtRYCkfN 9TIZ/DHAgP1ltSivugV2A== X-Received: by 2002:a05:6a20:728c:b0:3c0:b4f8:bbfb with SMTP id adf61e73a8af0-3cbc03b5531mr13804904637.22.1786228224701; Sat, 08 Aug 2026 15:30:24 -0700 (PDT) Received: from localhost.localdomain ([103.178.204.72]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-315beb877b4sm27463910eec.19.2026.08.08.15.30.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 08 Aug 2026 15:30:24 -0700 (PDT) From: Sreeraj S Kurup To: alexander.deucher@amd.com, christian.koenig@amd.com Cc: amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, airlied@gmail.com, simona@ffwll.ch, Sreeraj S Kurup Subject: [PATCH v2 5/5] drm/amdgpu/aca: Fix off-by-one buffer size parameter in add_aca_sysfs Date: Sat, 8 Aug 2026 22:27:42 +0000 Message-ID: <20260808222742.2859-6-sreekuttan2156239@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260808222742.2859-1-sreekuttan2156239@gmail.com> References: <20260808222742.2859-1-sreekuttan2156239@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" snprintf() guarantees NUL-termination within the size limit specified by its second argument. Passing 'sizeof(handle->attr_name) - 1' unnecessarily reduces the usable buffer capacity by one byte, causing sysfs attribute names to be truncated early. Pass 'sizeof(handle->attr_name)' directly to snprintf() in add_aca_sysfs() to allow full use of the allocated buffer space. Signed-off-by: Sreeraj S Kurup --- drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c b/drivers/gpu/drm/amd/= amdgpu/amdgpu_aca.c index f22b58c559b6..c2fe98b83eee 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c @@ -682,7 +682,7 @@ static int add_aca_sysfs(struct amdgpu_device *adev, st= ruct aca_handle *handle) { struct device_attribute *aca_attr =3D &handle->aca_attr; =20 - snprintf(handle->attr_name, sizeof(handle->attr_name) - 1, "aca_%s", hand= le->name); + snprintf(handle->attr_name, sizeof(handle->attr_name), "aca_%s", handle->= name); aca_attr->show =3D aca_sysfs_read; aca_attr->attr.name =3D handle->attr_name; aca_attr->attr.mode =3D S_IRUGO; --=20 2.54.0