From nobody Tue Sep 29 10:32:16 2026 Received: from mail-pl1-f172.google.com (mail-pl1-f172.google.com [209.85.214.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 053C2288D0 for ; Sun, 9 Aug 2026 08:49:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786265349; cv=none; b=XBTo/EfUKlhaIcNwYxMu7UkN/o9XzX4yL9OvZ7VavCNOupS43PfrUGuEIUZDaQsBflyYcIdd0+WvxexvBG89x2oRdA+H+RbFvPLPcsVX4n7WfHlOTVU8S694B3m1yAI2wLAL3YQvD2qlEhLohOdrkiWQxVNqSL5AsUIeF5rEryc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786265349; c=relaxed/simple; bh=aDj5aLG7NStNslfYhTIl3YYv6XZgFNUFXK8u7qYzlf0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=a16wPZ2MljVRzKrQ2TQc+zv5vgUlK7AQDF48GFrOUgJsM+7Z8bMdgbGuc7pJFo6tcAIQw4GvJiiR7Qcusv+xIjHZYDj28vytsjupmY5SWP4u6woFypcr+INkKzs0cUyVnCFTu1Ha0TelmTCXxYdch92fdZPtCo/FwLeLj9Mau3s= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=KV1YkOYB; arc=none smtp.client-ip=209.85.214.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="KV1YkOYB" Received: by mail-pl1-f172.google.com with SMTP id d9443c01a7336-2cace91f112so8802745ad.0 for ; Sun, 09 Aug 2026 01:49:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786265347; x=1786870147; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=A3BeIAtfJ2/omVu82I5VMk45uIa8CTiHrIT/44X40ds=; b=KV1YkOYBupWUgWgNtlRGiBYDULkjyE8AILK1NUpjGDPbpEU+4T4Utx+Vb6DVNHQ7kO dXh2iE+KbfXxX9bTa9Q5177KbNWES8rUfl0Y1KPIgFTrSPWSjoj3ej8zETwWinTGR6C9 EpgvJ20Yl4FybUW051gkTTP0+u4+kY3GXVWQgX/15GeErcG74mlcpPlJJsPesaRVxoRW 4E4caw868Fn1W+CQzN0HGBxeOAr2W//JkaGaoVr9UdbkHT51X3MEYeLBD5eq53XK6A5C UERcvCtRudXWYM6wnvYfNmG4sJV5WxD8+vBN+Yc2UX2PNyb8N8Gxkc+gyCqfH4aRP2WL cPEA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786265347; x=1786870147; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=A3BeIAtfJ2/omVu82I5VMk45uIa8CTiHrIT/44X40ds=; b=og+kN9aSH8Q210HVCWbdJctiB8mIGU4D/ElMIN9RxBYfucynvJ6sB7Ss3/6dPcln2x eiAjxkMxNfFudZsqnoMtFIPKo6q1IjlCkb/ChHoua4kDiT+jvNVTrnfD/z9up8UpPmBD IXO3R328T4+snFqlVNvtgVNRpgqYK2qT+6E++vPO+rCkG11CpqdeXH0+BfnOmWuT9vQJ J3TbxCCm5eSVnFb7DAGP36W7vOeJm7uO63ndhlG0yXjHMp1a2xiB5bcR4RiEira4r24g HDajmuQCZwPdS2OImDaOeY8RN2QVrM/X3BpheRkUEUYLHeOxjIjwej5aU7yaQAEiJOoW IkoA== X-Forwarded-Encrypted: i=1; AHgh+RqPOtmGB8rJvYAA6as3ZNEsEVTVCke0axh50OFC89/k6rpXhMPJ0Ay8scYPFKIBM/4JSDiamWmO5IYh0jA=@vger.kernel.org X-Gm-Message-State: AOJu0YzkRc2dpW3mBvSaYZoZAuVSDcepz4EHkXpwJO8i3J8E6KD2xvKF bB0QbPwcqjCIYti4cN7gdfhTexg/kIXhBDDw+S8JagBikG+GOQFU0k8F X-Gm-Gg: AR+sD13iBIRVqPWhdXZ+guXpSEKpfvj21Br09x2eAzhXXsXfU51PkcoDNKdBChC06eM z3Q1fWdLCXwRr2HdOJwk5M+LSaEGo+7tDy8CdNDVQjfJ0fxcfipHGbhPeBftQMP/C8Bb99CBRl5 jk7jgxQZHTfy6sRQeVduqSVTnrFQrEBcelLBkRpneVKxEqLq29OxTmALrb4GDnCRQgCutiLfhl9 wUyZ/YW97jXpB4V8YJ3rtKM6yfEFdYkl8UBw1GcickrTslC50DR37X6q+1be98vHzB4Ra9ElHQG QNaJKW11s+rS1JA7PJqQ6EZTwmmjz4MwXLGs+Pk8qcwdqJ6f9pP8eBXIM2Juub9JtjKRfgYLKqW L4oRivevqISNDjKpfPv2R26uEpYYX5Zcq5CSaueddbPyRDc/dzgRKRx+G2I9/UF0QJBweF2cMfa jRWM+ZO78N2qjvpAvKbN4tmiX2qnCvaQ6c+hwoAHKAUPfI8D1rIgw3LYRHJbXC6zOeoaMbPu0le ETbdETNawI= X-Received: by 2002:a05:6a20:9e0e:b0:3c3:66c5:68cc with SMTP id adf61e73a8af0-3cb85efa4f9mr44179451637.21.1786265347177; Sun, 09 Aug 2026 01:49:07 -0700 (PDT) Received: from localhost.localdomain ([103.178.205.91]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-315be86fc7bsm28800025eec.1.2026.08.09.01.49.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Aug 2026 01:49:06 -0700 (PDT) From: Sreeraj S Kurup To: alexander.deucher@amd.com, christian.koenig@amd.com Cc: amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, airlied@gmail.com, simona@ffwll.ch, Sreeraj S Kurup Subject: [PATCH v4 1/6] drm/amdgpu/aca: Fix race condition and UAF in error cache logging Date: Sun, 9 Aug 2026 08:47:30 +0000 Message-ID: <20260809084735.9743-2-sreekuttan2156239@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260809084735.9743-1-sreekuttan2156239@gmail.com> References: <20260809084735.9743-1-sreekuttan2156239@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In aca_error_cache_log_bank_error(), find_bank_error() released aerr->lock prior to returning bank_error. This created a time-of-check to time-of-use (TOCTOU) race window where a concurrent caller of aca_log_aca_error() could acquire aerr->lock and free the bank_error node via aca_bank_error_remove(). When execution returned to aca_error_cache_log_bank_error(), incrementing bank_error->count resulted in a Use-After-Free and potential kernel memory corruption. Additionally, bank_error->count was updated outside mutex lock protection. Fix this by acquiring aerr->lock at the start of aca_error_cache_log_bank_error() and holding it continuously across lookup, creation, and counter updates, while removing redundant internal lock acquisitions in helper functions. Signed-off-by: Sreeraj S Kurup --- drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c b/drivers/gpu/drm/amd/= amdgpu/amdgpu_aca.c index db7858fe0c3d..d0d473082431 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c @@ -237,10 +237,8 @@ static struct aca_bank_error *new_bank_error(struct ac= a_error *aerr, struct aca_ INIT_LIST_HEAD(&bank_error->node); memcpy(&bank_error->info, info, sizeof(*info)); =20 - mutex_lock(&aerr->lock); list_add_tail(&bank_error->node, &aerr->list); aerr->nr_errors++; - mutex_unlock(&aerr->lock); =20 return bank_error; } @@ -249,22 +247,16 @@ static struct aca_bank_error *find_bank_error(struct = aca_error *aerr, struct aca { struct aca_bank_error *bank_error =3D NULL; struct aca_bank_info *tmp_info; - bool found =3D false; =20 - mutex_lock(&aerr->lock); list_for_each_entry(bank_error, &aerr->list, node) { tmp_info =3D &bank_error->info; if (tmp_info->socket_id =3D=3D info->socket_id && tmp_info->die_id =3D=3D info->die_id) { - found =3D true; - goto out_unlock; + return bank_error; } } =20 -out_unlock: - mutex_unlock(&aerr->lock); - - return found ? bank_error : NULL; + return NULL; } =20 static void aca_bank_error_remove(struct aca_error *aerr, struct aca_bank_= error *bank_error) @@ -306,11 +298,15 @@ int aca_error_cache_log_bank_error(struct aca_handle = *handle, struct aca_bank_in return 0; =20 aerr =3D &error_cache->errors[type]; + mutex_lock(&aerr->lock); bank_error =3D get_bank_error(aerr, info); - if (!bank_error) + if (!bank_error) { + mutex_unlock(&aerr->lock); return -ENOMEM; + } =20 bank_error->count +=3D count; + mutex_unlock(&aerr->lock); =20 return 0; } --=20 2.54.0 From nobody Tue Sep 29 10:32:16 2026 Received: from mail-pl1-f180.google.com (mail-pl1-f180.google.com [209.85.214.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7EE5812B94 for ; Sun, 9 Aug 2026 08:49:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.180 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786265378; cv=none; b=SQn9QN88g5uBm5B+laZJDRQhowYQS1m3yKWS7m/56adxkGB7CV8a2LE2/rtExxydSeBwkK8OqVtw5/JQP7ZaZK3afF+uH34lG/4E4ksIkUHUDfzE26itd2+3AGa1e/EmEsliOl9HLzoC1xHrrMbfYYl6ucuVYKUMtPFJkZ1GWyo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786265378; c=relaxed/simple; bh=weRrChkTJgmtJ7e7uWxoKD+8+f+Z6NRdCPQ7Z7d8o5s=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=fFNy7VxZ9ey1aC1Dwgt+web9KjQg5t6bwiZw0KHjhruzVjk0kSe/heWmN4Zt64U8GS6Oh9RUKLXUXRNIwm9VvWl+nhOdNRgr6DBGKvSuoZ+eZBBHNI97QixnzJYqdchQdLyJCcnrMldb/os5L0SkAk4dpH+od49Wm0T6qfAMY3Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=gp0yyGzc; arc=none smtp.client-ip=209.85.214.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="gp0yyGzc" Received: by mail-pl1-f180.google.com with SMTP id d9443c01a7336-2caed617615so10848445ad.3 for ; Sun, 09 Aug 2026 01:49:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786265377; x=1786870177; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=deoqn41jn4hqxaXBU0LER8gLC0cAyHmrQg56bcVPpQA=; b=gp0yyGzcwPkxCiqRqFyuJf8wQbqTQbFlox/4Iei4pxSOC5xYGzrwH474bMf9Ngwi/V sQJNktOFt9P/WH16wemjKnNxWKc2vmEsNzOQYB+Upri5po/VaIAZP3yv9wzmcVX4XH6d NT+T6+OHhH3njo+fjsSyuAFMAKKfn4M4OV3iTLbi/74GV65IYUbaMVI6gv+qB6uRJDO4 cV74t6qSEBefS7596hELdeNsUJOZC1rfaVPeCAex5Toyhk8epeLd6RnEr5IK9QwJDoMa dQTeH65SeGBxoKq4rnEVGkQB7MJ1DUlDV4MZJisbrGXWZ/PCpcfhUWKRBX6FWz7AtYok k+AA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786265377; x=1786870177; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=deoqn41jn4hqxaXBU0LER8gLC0cAyHmrQg56bcVPpQA=; b=BHMqu72A4ldm3yzPcNwUbrdHmsQXkl5dKgMu8gRczlKXEkOFjyy0Z488l+S3CX3P3Z cuaC/iUuxY0d4XLFjCojaXekvLO5Dju3SVlv1qa+jrmVw+Ecz6NYysFqfY8Wt+C+jaWY kcn/b59HsfqJLs6ZtqW6mZqGma5xLAnw1ifHe2AiVJRTi8sIuqh2Z8MoQE7YK4xJlWPF fJYHoE6E5kz2l1s6eznfZac6spv2iOBcFn1Nvpse03OCltVM2D5ZqJWJaeC+oVkIkth/ lDjCRhunmYZKx931cFumOLdkXvPPMm6we9hoLTb2nDO4vztIa7J9hVvNFvIfEqUjpgmx SuXA== X-Forwarded-Encrypted: i=1; AHgh+RrXCk3a+SS92iCYM7XGFHMPKrYTz8/ifZMdydfTfR/nelxA//+Zbi4kaGRAmlmu/4gtbbi5yRy3BwAxVWo=@vger.kernel.org X-Gm-Message-State: AOJu0YzZEkVFVm1TAE5GsXmsMYmfl0mk8BLtSt1khtxLFGMQhDyNUya7 vtnxRTm3gZmmZQFN7wOm6mVj3vGciEG71Tmo6+97WiB88Lcdk4YBruOZ X-Gm-Gg: AR+sD11SYFM2p2aYWSCf8OsFU3LkR8S4glotkk0QhcUJvs/l9K32dX3hKZ9Z+2E2l5e hO2bqiuBs+yX/nVVaXGV18BxEXNZOalx7CcXsoDLh6Dcn2ULqAQxcRWTNTO8reFG7LUMrLmaKbJ P2kybsckk1EiUDIY0SpTcBA0J5Auua5XLb/aJzBBsxuj+VTQCamgKmsteWOAqrZtzXkJ0D+U75X y8/KQAWBqHv55cySFdMTD9rqbWqakmix4IQVOivYx4J9hk7f3swk/tc3hNX0lEBKQ9S+T9iQGFd YadhN4G1JwHkptR6I/igTwRFPZoKD5GfKiHudcCaoqBZMAxVkffQBheQA4F+6xzNXBldQSPznVz /iOhVJxPfL/8EMwqsXwieRqz7Dxwn58E/q8CGNQWMQyHhQz2YvYGCOnKWMe8tcO5PnBm/E5+oFu FTz0Uj4LUV47DNK7o6tZ3sF/Y+9rFSOBqMaF3iBeE2ImyM1s+4Vrk8ZKm0kGM2ZQqKf2iMoGnjU bsL5aQkRDCIJ8HE38eAiA== X-Received: by 2002:a17:903:46c7:b0:2c9:b48c:fdec with SMTP id d9443c01a7336-2d0ca75d2admr449178665ad.12.1786265376710; Sun, 09 Aug 2026 01:49:36 -0700 (PDT) Received: from localhost.localdomain ([103.178.205.91]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-315be86fc7bsm28800025eec.1.2026.08.09.01.49.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Aug 2026 01:49:36 -0700 (PDT) From: Sreeraj S Kurup To: alexander.deucher@amd.com, christian.koenig@amd.com Cc: amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, airlied@gmail.com, simona@ffwll.ch, Sreeraj S Kurup Subject: [PATCH v4 2/6] drm/amdgpu/aca: Add upper bounds check in aca_bank_hwip_is_matched Date: Sun, 9 Aug 2026 08:47:31 +0000 Message-ID: <20260809084735.9743-3-sreekuttan2156239@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260809084735.9743-1-sreekuttan2156239@gmail.com> References: <20260809084735.9743-1-sreekuttan2156239@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In aca_bank_hwip_is_matched(), the 'type' parameter is used directly as an array index into aca_hwid_mcatypes[]. The function previously checked whether 'type' was equal to ACA_HWIP_TYPE_UNKNOW, but did not validate whether 'type' was less than ACA_HWIP_TYPE_COUNT or negative. If an invalid or out-of-bounds enum value is passed, an out-of-bounds memory read occurs on the aca_hwid_mcatypes array. Fix this by validating that 'type' is strictly greater than ACA_HWIP_TYPE_UNKNOW and less than ACA_HWIP_TYPE_COUNT before performing the array lookup. Signed-off-by: Sreeraj S Kurup --- drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c b/drivers/gpu/drm/amd/= amdgpu/amdgpu_aca.c index d0d473082431..c76664af9902 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c @@ -138,7 +138,7 @@ static bool aca_bank_hwip_is_matched(struct aca_bank *b= ank, enum aca_hwip_type t int hwid, mcatype; u64 ipid; =20 - if (!bank || type =3D=3D ACA_HWIP_TYPE_UNKNOW) + if (!bank || type <=3D ACA_HWIP_TYPE_UNKNOW || type >=3D ACA_HWIP_TYPE_CO= UNT) return false; =20 hwip =3D &aca_hwid_mcatypes[type]; --=20 2.54.0 From nobody Tue Sep 29 10:32:16 2026 Received: from mail-pg1-f176.google.com (mail-pg1-f176.google.com [209.85.215.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 64C9078F2B for ; Sun, 9 Aug 2026 08:49:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.176 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786265388; cv=none; b=reBaJxjOTNrgy+iEcLY09qAuXhOMDufuEFoK5fb8/3LzTTMQl38t+5IyGLbT8goYeFxeYKCEdU2hsuVMN8SdM1JSV9eOH2Dn4fBkRr6wE+vP65aHCFg2Ee2e6Egsw2XbES/7SmcLgP0TveS5K0h/OTqy9uX1F9C19/uxkT5PjzQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786265388; c=relaxed/simple; bh=mlq/3tdlJrEy6qPNfLBgSwS1uRqxNWYL9wgbN6jmUmk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=oEP3ncUVC9K6qE1XnexiAcw5EmWAj45zD5duaiLZHpBqzQAaHDvtqlOhO7Y2UDKoOsqBmmJb5vGgob5PlZcaylzVIwDuDAPDCMSed6htiM5UWhHq7HBx40mGd+zLma5nSjidLMawZ9vo3AWZTOI4ihqKbA4lkDEDz5XLUKubmn8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=aKW3rW22; arc=none smtp.client-ip=209.85.215.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="aKW3rW22" Received: by mail-pg1-f176.google.com with SMTP id 41be03b00d2f7-cbe3fed2f58so639294a12.3 for ; Sun, 09 Aug 2026 01:49:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786265387; x=1786870187; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=82v9sYNKKB3ALGXPfLnFRe1IYhxbaPWojRznailPiqg=; b=aKW3rW222XW8YCKBaMudnmeDQdT/RiDCeJAIlW4Rv0Ucg8MKFXBo0VkcF/FiH0FaNI +TPDSb1clnoE2Vzr2tcZkaJW/jLFjq9gCda7nIE7iYUFVTzLzQeuite3JtRLRvUUkh9Q /3UIwUhSI+89Dx1i9+euCmil3P8q884M6lsP+f+8RA0cNBtwp3uNuM8WB1lUfTWZOddE TnyBf+sVjxqMCRmlsDKbKoHSFeZcVq3EbiwZ1EVaTPmW+4Kz8bop9CrpHIyL/clqmqwt qgqni2TarB/BXgYZ/WYgehbDpt3Z/FDpkn82YzvUVsTJfa22xSZrYTnRZrTGb3j7ZHp3 KQ5Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786265387; x=1786870187; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=82v9sYNKKB3ALGXPfLnFRe1IYhxbaPWojRznailPiqg=; b=iDHK5D4sYP9c4o/1Gsszc9ZFRl3F378C92tl5X7suLdWNr7IwpGrtFN6RuC6APiKJf /ZhlxTqID+lQjxNH7aWIRqg9Ig1a6ntl25DRBfSe7Z6rfPxgM1cqB0DyVJkN1n8iCQ3l PUDywaJ8NgUorHTpDOUuK4CN910Yl4dklpbrpEcO9LhCAyJIK6nvdj97ytyqkJhbjasV 3gHNokd6i/FxBomqPNifayzcC9EwZyC1ujdfZY13yU7mcH852scYJRPpKU3WhoJM7n7v OBtYYEaEiswQbzLIYTqd+/b2mYFjXWjPoGAlZioHdPGwFtzG3WWyCktok0SWrUw64m22 gNHg== X-Forwarded-Encrypted: i=1; AHgh+RoWkG0uWELjtYcuO3TrsQ6m9VD/zS8LiZLJO/Mu2AotMOxvekS8Fz8kTYWYX36D9qwzgIl6LdD74rRBnV8=@vger.kernel.org X-Gm-Message-State: AOJu0Yzh2DN8I6tkCfI16RYLRYstEMIWF5ceTJVUEbX3ujp0ilYX/oxS DhNooX69vlZUxcM+qs9zgyg+nwb6GRciJOBqIlIUFjTaHliWxLzL4Ysi X-Gm-Gg: AR+sD11GAQOEb3G8N8ouRhN18HJecYBDSjg783y9S2JsdsuPIf/AmuJh+ylum6oQkiv 5JcWIoJYmlaxI9jL8xvX+bos+nwVujVaETV2WRWJhQj5bp9AM6J1lJjjMWbdTf0DAl1ILJRnJqO PoKai5c8lFopwn+8RCN65Nnf2+qyM0h0uoUA1vXg8K/FOUlxH4M95pae60ZlDFeR20+auF4P8qC MXb6pAyCZossvc6HQNhdNP4t72KHWGQRUUllkzeifT3BtMCA0Yj+s5nQI/iK/iS6J9k635U9GtT rJXKImDPeQ7AHQhB4ZjVOuUFRWq6+McA0jQrpeSZuURqKFsJATYSswHZBIg9D/WdEKfLqE7Uf4c hI3BdV3FENBCBmFFpNW/fuyvc0WbCBQ16CVm9saF+FxLZlPbTkVfzAogah7LcXzroF4qyT6dorh yKrtSTrB1T9L8HT+pYdCppdT3vesekwYUNh7sOW6O3c3oqLXKXwUSzu3EYU+ah+b6b9SI440CKE hnVDp5nTGo= X-Received: by 2002:a05:6a21:600f:b0:3c3:8651:b317 with SMTP id adf61e73a8af0-3cb85e2b72fmr40290617637.10.1786265386693; Sun, 09 Aug 2026 01:49:46 -0700 (PDT) Received: from localhost.localdomain ([103.178.205.91]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-315be86fc7bsm28800025eec.1.2026.08.09.01.49.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Aug 2026 01:49:46 -0700 (PDT) From: Sreeraj S Kurup To: alexander.deucher@amd.com, christian.koenig@amd.com Cc: amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, airlied@gmail.com, simona@ffwll.ch, Sreeraj S Kurup Subject: [PATCH v4 3/6] drm/amdgpu/aca: Fix inverted validation logic and list cleanup Date: Sun, 9 Aug 2026 08:47:32 +0000 Message-ID: <20260809084735.9743-4-sreekuttan2156239@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260809084735.9743-1-sreekuttan2156239@gmail.com> References: <20260809084735.9743-1-sreekuttan2156239@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" aca_handle_is_valid() returned false if !list_empty(&handle->node) evaluated to true. Because active registered handles have non-empty nodes in the handle list, valid handles evaluated as invalid. Consequently, amdgpu_aca_get_error_data() returned -EOPNOTSUPP whenever aca_handle_is_valid() evaluated to true. Fix the logic in aca_handle_is_valid() to verify that the handle is non-NULL, contains a valid mask, and is currently registered in the list. Update amdgpu_aca_get_error_data() to check for invalid handles and return 0 instead of -EOPNOTSUPP so non-ACA blocks in global RAS queries pass through safely without breaking error telemetry. Additionally, modify remove_aca_handle() to unlink handle->node under mgr->lock using list_del_init() prior to calling aca_fini_error_cache(). Standard list_del() leaves node pointers poisoned, causing !list_empty() in aca_handle_is_valid() to evaluate to true for removed handles. Unlinking under lock first prevents concurrent list traversals from racing on node pointers and stops background queries from referencing destroyed error cache mutexes during handle teardown. Signed-off-by: Sreeraj S Kurup --- drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c b/drivers/gpu/drm/amd/= amdgpu/amdgpu_aca.c index c76664af9902..c35f6be2ef77 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c @@ -586,10 +586,7 @@ static int __aca_get_error_data(struct amdgpu_device *= adev, struct aca_handle *h =20 static bool aca_handle_is_valid(struct aca_handle *handle) { - if (!handle->mask || !list_empty(&handle->node)) - return false; - - return true; + return handle && handle->mask && !list_empty(&handle->node); } =20 int amdgpu_aca_get_error_data(struct amdgpu_device *adev, struct aca_handl= e *handle, @@ -599,8 +596,8 @@ int amdgpu_aca_get_error_data(struct amdgpu_device *ade= v, struct aca_handle *han if (!handle || !err_data) return -EINVAL; =20 - if (aca_handle_is_valid(handle)) - return -EOPNOTSUPP; + if (!aca_handle_is_valid(handle)) + return 0; =20 if ((type < 0) || (!(BIT(type) & handle->mask))) return 0; @@ -716,9 +713,13 @@ static void remove_aca_handle(struct aca_handle *handl= e) { struct aca_handle_manager *mgr =3D handle->mgr; =20 - aca_fini_error_cache(handle); - list_del(&handle->node); + mutex_lock(&mgr->lock); + list_del_init(&handle->node); mgr->nr_handles--; + mutex_unlock(&mgr->lock); + aca_fini_error_cache(handle); + kfree(handle); + } =20 static void remove_aca_sysfs(struct aca_handle *handle) --=20 2.54.0 From nobody Tue Sep 29 10:32:16 2026 Received: from mail-pj1-f48.google.com (mail-pj1-f48.google.com [209.85.216.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 199EE72621 for ; Sun, 9 Aug 2026 08:49:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.48 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786265394; cv=none; b=Bdc+9pQHhF7E8epT0kh2rZNlvAavSIUKwEa3ZNHcMXUzd+S4PGQ/4FvmGlVbf+U0hO7zKoN3aW7edIhKCfwiqO6MOZ536WQNfGywQmd5Eaemg8k66edfTzhrW0cXeKccCUA0yId0BrIHvFuGQf5zas2RLk73LL4fKtRJcEKJCEc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786265394; c=relaxed/simple; bh=AqxQ50uRgfqSVhDzNOAr9tvvTNsoXCcljj0EkkQ8A3g=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=cL/l0Sv2tPy/yCfZ1Vkq74M01D9kQGQHaylBxNagu5FUGHlgesyh1wgS2Mb+t5BKu0z/NN4mh7KgjEXyPVTGAg2Xh3xd4C0q/oAU+VAgfQXmG5rZOu0bchW7dEKiGytVmtMT/owqIpyl1Fzh/KOvk564miQmEFlasaAoWEPS6x0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=TtOuSM1t; arc=none smtp.client-ip=209.85.216.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="TtOuSM1t" Received: by mail-pj1-f48.google.com with SMTP id 98e67ed59e1d1-381c51fde6bso1053387a91.2 for ; Sun, 09 Aug 2026 01:49:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786265392; x=1786870192; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=yOuPd/8nIM02AL24kWbQs53dFhNPEGw5UKtvK4sm+fI=; b=TtOuSM1tgFXj33o8mc6VOXr5eghtYsUaAIZbQTg8TayM37WvbcUux+05K8Lj1LzsVl E4VtXg6YwbmCa+1KZym4nWEBalpo/f6xzEL6mVFfeiIfBnPSif9Pbt9sTTrbPr30frCX Xr97NAYW1Sx/7KzX50ZFSYnr8o6I/c46W6GiyvFo/nVbzKEya/g/JAZ+XOGg64I8T6kX w6nq0+DHk4xRlIBYDl8JZRvH8PwLaMDqCRXecW6AkCEX3TWDZz9dS5rDqlAdghcm+bCP ccIMlnYJtbwZ+Shl+OdLGFBd/FaV+kJY8L5lfnjUHSl+bHu+GJeyPE1NRQkNyHqsV9f0 w+qQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786265392; x=1786870192; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=yOuPd/8nIM02AL24kWbQs53dFhNPEGw5UKtvK4sm+fI=; b=eb+0/g4Boywgf3T8/NhfEoONZZfxk0r+9r6OgI+md9pNRS0hHnaoalkag49bHVTJWt 2WLU+X+mr6Sqbc71HWasfjrB/db1+FIFbU9prdZCBmdkbKA5OtJ5B2lbRQvhvhAc0FZe AnwhJhwHTKBfkkwi6xpXV2AoDcOW6QU0DRdowsEmurNw5oaCU7FXa/KGXcJ1rb1vRGk3 iyICx+JO/uabYj85HMqfu7EPcjZ5kiCBNmMGbOD8kpE/LOhMO+d6ZZOK0za2cFf7Z1gi OV9A3lhCABN6O2L/OLF74oRO7fzGYQszLs8XJNulHUtg6yd/iD0AE93/0pElTNRGaUon j5yg== X-Forwarded-Encrypted: i=1; AHgh+Rp5XQvUHe5YCf2LsV55kn0tXwiAG5tBbZLoiUY/YAxPciRLMtsoNVnSTYFk9V0ghZml4zIosYShvPPGync=@vger.kernel.org X-Gm-Message-State: AOJu0YxEaLUmpTAjXL8Rb8z8w2P1Q5g2pyxgUTMwiWRshVMnLDE4UsHq q/eq4N6KOsC2j2lSQR6WTjHzilRYx+SzzIa4eKPWH1hOBl6UbgIeL/Ne9xbxng== X-Gm-Gg: AR+sD10vmuGepnjcQK/5ayGDG5zbWuD3RD1l7hS1UdDvVra29D2cKFnYgvxT6ppO0sl zzII25Op0n0uzjWe+d2i/GVhRrlGomMH618F3w+EMSinoJ4oJUMG2PlD6f2FNJlmN84u8l7x1lu FB1l0irbA8pwY7V6Rajl+YvhRm3ad+j+7oXJKNzVIzrasLbvhtHyy1m4hkom0WB9vfC7VUiUXgx 0npreqrUREx0jN+10iDuqaVB8hHhMpkgnyZtSHU+CygBUpbC/8S+cYt+SbItInEozQHZBrOls2J cUs4s0+tqmN4mj023t5BoJCoeZGO9Loy5g6hlDnp7Y89QY/Tnm9UydTRDc+oS4WYcXn7Z4FrmGY fm4rchTYG8dxON/Kb3Has8IaWhWcjx0bOLemKH3sv2iSntjyc2/CM2k/H276xqtqnVpgruzkqRD BUU2yCCvMk/BSO5wz1JNZxWGhs69R5l3aTRNU2bCU8RRgrHn9aeddTW/JtYXMQ2ftoWOZbfkqX0 IRnKuqV8Gs= X-Received: by 2002:a05:6a20:1602:b0:3b1:cce5:9140 with SMTP id adf61e73a8af0-3cbce98a610mr14359456637.33.1786265392386; Sun, 09 Aug 2026 01:49:52 -0700 (PDT) Received: from localhost.localdomain ([103.178.205.91]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-315be86fc7bsm28800025eec.1.2026.08.09.01.49.49 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Aug 2026 01:49:51 -0700 (PDT) From: Sreeraj S Kurup To: alexander.deucher@amd.com, christian.koenig@amd.com Cc: amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, airlied@gmail.com, simona@ffwll.ch, Sreeraj S Kurup Subject: [PATCH v4 4/6] drm/amdgpu/aca: Add missing NULL check for banks parameter in aca_banks_add_bank Date: Sun, 9 Aug 2026 08:47:33 +0000 Message-ID: <20260809084735.9743-5-sreekuttan2156239@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260809084735.9743-1-sreekuttan2156239@gmail.com> References: <20260809084735.9743-1-sreekuttan2156239@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" aca_banks_add_bank() verified that the 'bank' parameter was non-NULL, but passed 'banks' directly into list_add_tail(&node->node, &banks->list) and incremented 'banks->nr_banks' without validating whether 'banks' was NULL. Add a NULL check for 'banks' to prevent a kernel NULL pointer dereference if an invalid pointer is passed by a caller. Signed-off-by: Sreeraj S Kurup --- drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c b/drivers/gpu/drm/amd/= amdgpu/amdgpu_aca.c index c35f6be2ef77..dcddeb381628 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c @@ -49,7 +49,7 @@ static int aca_banks_add_bank(struct aca_banks *banks, st= ruct aca_bank *bank) { struct aca_bank_node *node; =20 - if (!bank) + if (!banks || !bank) return -EINVAL; =20 node =3D kvzalloc_obj(*node); --=20 2.54.0 From nobody Tue Sep 29 10:32:16 2026 Received: from mail-pg1-f179.google.com (mail-pg1-f179.google.com [209.85.215.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C17332E401 for ; Sun, 9 Aug 2026 08:49:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.179 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786265400; cv=none; b=SNOpxYsfXBBKVobwn//yaXVLlra9fPI/Wk39NNKhKize7Caj1Le9n+EzrV05eC2QhzkbMJxxEmxh47SgNljZmGe8VQMySJsiwIcbtCwA7de5ccF8S1SRTCvB5VhArNipdQ48Tqv3X/eS06lMiJsWPcph2pMFScEcYX/bynVlzFw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786265400; c=relaxed/simple; bh=cOe7wAtEpKGz1IubsJOZd5Kh2Q649IZb8GAt4BDiQGs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=O4I9rqD8xwCW4cRUPJB2eCUI/ckeJqTWuI6EECycTpVG7DDyTa+z2uAi0ix2gbn++Tmg27pg+AWoHHAG8IE7E7BODl8ygP1XUC0gC4FJGr/wDwHa2aHXD/hW0SQcmw+gPgdT+6V3K20URc9U2NW17kCApW4jVWgMxs8sMICWSNo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=CU7NT3VT; arc=none smtp.client-ip=209.85.215.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="CU7NT3VT" Received: by mail-pg1-f179.google.com with SMTP id 41be03b00d2f7-cbb8b54fcf8so622515a12.0 for ; Sun, 09 Aug 2026 01:49:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786265398; x=1786870198; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ohuKFNYedefwgEV1kOLtJZIOQiLf64k0Qg77YlHmp8s=; b=CU7NT3VTDbdpc3ww8VftkEztVyh0bX0ZE5WswcGgu6J+PJspJS/Z9kW4b/GLL5BFdT ZXSe5IDCaCllkiymq8ptI7q/Ur0TNpSTBeebHqBDqQ3lE33Qin98oXIZ32VZ540e3Pxk uz1BftYF6103TwVZXERFEC/dQjoLsSMuR/8PlO4si/vY6UqsaT2FI1hE1LmRNKgtyUFM bZqClOkufJetREJPL7G2U2qJnlTjisfWmPTVKcHzK2t6Vi4gxwFVttQ6roBRSiHUvpG9 q7xqUb2S7NY3AtuSGIMl7Nyp5JOZfwH85YuOEbP4DGH3Di3hNSJxbVWXCtan0Yi9Wlzx j0Eg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786265398; x=1786870198; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=ohuKFNYedefwgEV1kOLtJZIOQiLf64k0Qg77YlHmp8s=; b=EuW/VdnIWy1MeiYEIsyFHnpBY4wXROK9CBo7xiSr9QeRHFBpEzha7FOkpwD+jU89Zb YCfyicyYkuEW8qCErDRW9bG0ItH1ImT1zvaw1DwR4fcBkkvX9u+jTKy/AGYwka8CRks6 kTkRKcAXOyJMBAZWilT8rSFbm/FF4AYhMpx94S0FEGzK7hRjyN6lz2jqw8OZCvlvKDia yF1AyQ+yffaS0o1rW7JLYj9Hp9H7ooQZL841sq+NpbXVdtSEkk6XO/O2iFvW5UpqRMxU olgBXHBSV6VlyYQizGVfoj/FiQ7HqAso02u3Vum4DWV+ui3pcFJUDj1BeKLZXjtUUKZQ DDBQ== X-Forwarded-Encrypted: i=1; AHgh+RopdbEMvQ8GNywxdm+sVreN6ZRWurXk5WlpoYuIDSJap38eQFiG1zMpe0SbnF+7kBITy72wi5cjbSCM5NQ=@vger.kernel.org X-Gm-Message-State: AOJu0Yx1XDvjwH+QNmBTFTEAlKqc8pzdE/iqKXevQZZhTDMCChJsdbZa bH0NwTK586JJ71rBKzP5J6TVItQRBb/8ahFS+3HiSpIoVvW+Fo5oXxqq X-Gm-Gg: AR+sD12sADzVzORRTxjxL8oQGm+kvdPWn9tAHWri6/yQwoHhh63plBCT4F6I3BIpIIW fQeo4+rXs8OqabPg+4eVjWSkN7Er7gDWRSfFuhpFPDd/ukPDJUcvGGcpJJaAkV+lQYJXh9KxG+w PVDd6BJEYDUnoPg3AhTk6WOQTaG3rn4BUpuvjpN+jpBmPENKNQV4+2zPIIlyaa72T16AVYwKRCF x/y/Gd3G4S5tyawa1jWz8n6zip4x6V8tjNPmeQYXpgCti/m/Kk57/7tMAh01ljpuV71SNpLx/yZ 6c85uKVacAlfI2BQkhIvJEuywwwHjN/QZgTVzVnCi47mKB3/7aME8HppFyxR71oFSPrthovbMBs a0gf4zfXZEECVqmuPbgKmoj7zq6lk8AKRasHbh1BE9Koosc68MQtO0Jw1YbXSyPpBc0iV17N0aR ZZl/Zc6vsXelII5NUjxcMYCjz57G/ZGlnAUigrkK35z3xziFEbuNSFIdsmWbGl3PCq8G2tEZE/R LOtnag3lXg= X-Received: by 2002:a05:6a20:6f02:b0:3c4:511e:26ab with SMTP id adf61e73a8af0-3cb85ded984mr46153927637.3.1786265398022; Sun, 09 Aug 2026 01:49:58 -0700 (PDT) Received: from localhost.localdomain ([103.178.205.91]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-315be86fc7bsm28800025eec.1.2026.08.09.01.49.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Aug 2026 01:49:57 -0700 (PDT) From: Sreeraj S Kurup To: alexander.deucher@amd.com, christian.koenig@amd.com Cc: amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, airlied@gmail.com, simona@ffwll.ch, Sreeraj S Kurup Subject: [PATCH v4 5/6] drm/amdgpu/aca: Fix off-by-one buffer size parameter in add_aca_sysfs Date: Sun, 9 Aug 2026 08:47:34 +0000 Message-ID: <20260809084735.9743-6-sreekuttan2156239@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260809084735.9743-1-sreekuttan2156239@gmail.com> References: <20260809084735.9743-1-sreekuttan2156239@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" snprintf() guarantees NUL-termination within the size limit specified by its second argument. Passing 'sizeof(handle->attr_name) - 1' unnecessarily reduces the usable buffer capacity by one byte, causing sysfs attribute names to be truncated early. Pass 'sizeof(handle->attr_name)' directly to snprintf() in add_aca_sysfs() to allow full use of the allocated buffer space. Signed-off-by: Sreeraj S Kurup --- drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c b/drivers/gpu/drm/amd/= amdgpu/amdgpu_aca.c index dcddeb381628..3da3d369a918 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c @@ -682,7 +682,7 @@ static int add_aca_sysfs(struct amdgpu_device *adev, st= ruct aca_handle *handle) { struct device_attribute *aca_attr =3D &handle->aca_attr; =20 - snprintf(handle->attr_name, sizeof(handle->attr_name) - 1, "aca_%s", hand= le->name); + snprintf(handle->attr_name, sizeof(handle->attr_name), "aca_%s", handle->= name); aca_attr->show =3D aca_sysfs_read; aca_attr->attr.name =3D handle->attr_name; aca_attr->attr.mode =3D S_IRUGO; --=20 2.54.0 From nobody Tue Sep 29 10:32:16 2026 Received: from mail-pl1-f178.google.com (mail-pl1-f178.google.com [209.85.214.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CC2C633A6EB for ; Sun, 9 Aug 2026 08:52:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.178 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786265530; cv=none; b=CZoqnGdvyCGFS/4fAlVpDbt31zyYRdnRRpex5TL4pFQfsvcgvfB0bjha3M/a4l3vnyEnuIkV0N4aQmyyIg5ksavEW3Gwz3v3YSQXpuvSFTVlqfZzs4ssxgEMPc2VkHuq9z6O/mOi1o+5AoFt1AR3cDeX/b8EftAJF2oo79Whdqw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786265530; c=relaxed/simple; bh=sxKZAH1YTVniJZgci/Dr6SqZEdTmzqVp+ZjlBNb7eqA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=lDouFDwqQc/0gK0kknNBw9KOIs4SVK195YKPHMHsVy5csPzj3vNhafViOya8onUaeMjy98RvgKjhHuPUmQb/xQfvsIk9Ucg5tUTPH2hdP6/MNmm+RCIKJRZTGBgZfzln/d+8VCi0JA3SrR7ZRsGPnKUaHyP4M8q0EPvimah4+8k= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=mdGwzeDB; arc=none smtp.client-ip=209.85.214.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="mdGwzeDB" Received: by mail-pl1-f178.google.com with SMTP id d9443c01a7336-2cc73e322dbso8558775ad.1 for ; Sun, 09 Aug 2026 01:52:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786265526; x=1786870326; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=c/m4TAD904Gpx4jOO1f1keOOyQGwoQabIUB++Z17kjo=; b=mdGwzeDBg56gZrx/tLx2jO729tLS4CLg/rGLvLtgldOAbpVx7IfrxwL5qJyTiNIge2 010FHWCzQAJFT5+O5NHtMdyq4CB6mteK8gL2chScsVQ/Bz9wi69627sbRO3gL1Gu4eQu JkWGPl2NxQzY8Cd5jdwwHwJYVCka0qdVfckcTe/hz0ykR/qZz+HvRNLEryo/P4+HcOzp l+UuqpnGF2JhtwnsmX2enySR8VAeeABnoKNIfNedKoW7Z/PfDywy4Gk60whQtAvsmvfA 69km7V020B0oorqagR2YzZwxD+rFl0oF+7x223Cvq0uoCOtJ3QgE+xvVuL/IKOG89EnP W3zw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786265526; x=1786870326; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=c/m4TAD904Gpx4jOO1f1keOOyQGwoQabIUB++Z17kjo=; b=QBZmzP7ZIbYbwcyylVr3a0AyxuD+K7ONU0QIHOxGDXpLVdD4+rMxnHpItYy7Im3F2H xi0U7R/J7ZyxL3/ycy/bOSZuA1atMmOY827G7nrVvEkA/Q1kti7crpgHDC+QTq+/IJlj +U9QjWU1WI66ofF03OI1WrcN1LVyuLnBV4B2zC3DXzVNHztSyV8ph4ExV7WF+Dx/z7Nt Bb0mXnVC05aWO7v0rdPZDWtf++jzJH19RptspaCq4/+tEd3gl2JRXSbUCVss8GN9yZUJ Vy4JT0EaFFpnwgvFlZFXRYuUhxaCRZdfIJgdZpJV4NwE553B4ldpxkVmNT671Aodou7H B0NA== X-Forwarded-Encrypted: i=1; AHgh+RoaQiHiSG5FpW8KMB7KVMHn9WtPgb53oUEQs6pQCmcIgPABk3CwId+GGciFkgtn+z9bkOedpZC36WWHgzE=@vger.kernel.org X-Gm-Message-State: AOJu0YzNsWGatWwBESAKjfKAQThzZHwVH7NbJ0sQvoXH80NlGduHixdt iXDDUQZjN6fCnnpq0XKBT+TfCaUEI5fx7qvrIjS0DI20Pt3J4QqTgr0D X-Gm-Gg: AR+sD11EMzvEnQ+MXy3sx0GL5UoDVWAj3EgAhOBhSq+v6UU2Eoh+ZfDl6e9BHbgdlwP egwmQl/CQKZoz0b0h++PHpIJ1STryXL5bAdGCitCwA2f8glwV08ro+dZsEI6KchgnK0oy7LSoB3 4sh6q29BrxO5w0Y/lo/pdL7g3gUks5P1l9oaEJIM0fbMhBM5LNBPxxwzjZKEo/fxZzi+CoJJ3j0 xTDzk1uLQJCcrtJtFAjzhyHIV00BkMaVa65IdZ8nyYrtIrnPeRlDIL3JHvSi5DCj4EayuKrjGzl MLMW3IMc6Pup5Z5EC3UvHr8mJnI38rY2R80WyU3wgvbjsaYsk7ND1DZlx0JksFDCpxXJEvqznZT BUAu9UKsD5YB/apTU5PKfM6U3uWFVC3YYwFxQWZFT3UapAVlttqRRZCntkTSYzXX+vDddtfOlMg 9svohXveS7OH6YH1i5zWMWcHQFoxVK3/7Z5yCejEmYRq0IOizlGMleVjs6w6IbpmYsoc0mDbJod 8fV4GgJb6w= X-Received: by 2002:a05:6a20:a111:b0:3bf:7eb5:9459 with SMTP id adf61e73a8af0-3cb85ef9202mr36500133637.20.1786265525696; Sun, 09 Aug 2026 01:52:05 -0700 (PDT) Received: from localhost.localdomain ([103.178.205.91]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-315be86fc7bsm28800025eec.1.2026.08.09.01.52.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Aug 2026 01:52:05 -0700 (PDT) From: Sreeraj S Kurup To: alexander.deucher@amd.com, christian.koenig@amd.com Cc: amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, airlied@gmail.com, simona@ffwll.ch, Sreeraj S Kurup Subject: [PATCH v4 6/6] drm/amdgpu/ras: Fix delayed work cancellation order during teardown Date: Sun, 9 Aug 2026 08:47:35 +0000 Message-ID: <20260809084735.9743-7-sreekuttan2156239@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260809084735.9743-1-sreekuttan2156239@gmail.com> References: <20260809084735.9743-1-sreekuttan2156239@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In amdgpu_ras_fini(), cancel_delayed_work_sync() is currently called after ACA subsystems and locks are destroyed. Similarly, in amdgpu_ras_recovery_fini(), mutex_destroy(&con->page_rsv_lock) is called before cancel_delayed_work_sync(&con->page_retirement_dwork). If delayed work runs while teardown is in progress, it can attempt to acquire destroyed mutexes, leading to locking violations and potential use-after-free conditions. Fix this by moving cancel_delayed_work_sync() and cancel_work_sync() prior to mutex destruction and subsystem teardown in both functions, ensuring all pending work is synchronously canceled while locks remain intact. Signed-off-by: Sreeraj S Kurup --- drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/= amdgpu/amdgpu_ras.c index 764cd4950408..23b9844d9f1c 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c @@ -3994,15 +3994,14 @@ static int amdgpu_ras_recovery_fini(struct amdgpu_d= evice *adev) if (con->page_retirement_thread) kthread_stop(con->page_retirement_thread); =20 + cancel_work_sync(&con->recovery_work); + cancel_delayed_work_sync(&con->page_retirement_dwork); + atomic_set(&con->page_retirement_req_cnt, 0); atomic_set(&con->poison_creation_count, 0); =20 mutex_destroy(&con->page_rsv_lock); =20 - cancel_work_sync(&con->recovery_work); - - cancel_delayed_work_sync(&con->page_retirement_dwork); - amdgpu_ras_ecc_log_fini(&con->umc_ecc_log); =20 mutex_lock(&con->recovery_lock); @@ -4751,6 +4750,8 @@ int amdgpu_ras_fini(struct amdgpu_device *adev) if (!adev->ras_enabled || !con) return 0; =20 + cancel_delayed_work_sync(&con->ras_counte_delay_work); + amdgpu_ras_critical_region_fini(adev); mutex_destroy(&con->critical_region_lock); =20 @@ -4785,8 +4786,6 @@ int amdgpu_ras_fini(struct amdgpu_device *adev) if (AMDGPU_RAS_GET_FEATURES(con->features)) amdgpu_ras_disable_all_features(adev, 0); =20 - cancel_delayed_work_sync(&con->ras_counte_delay_work); - amdgpu_ras_set_context(adev, NULL); kfree(con); =20 --=20 2.54.0