From nobody Tue Sep 29 09:47:00 2026 Received: from mail-pg1-f176.google.com (mail-pg1-f176.google.com [209.85.215.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9E454264A97 for ; Sun, 9 Aug 2026 14:46:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.176 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786286793; cv=none; b=LxpDhqmx+eiTxk/flHyQr6cv5nKOjmcBUIEZlbl3b4qQbUQr4yC0Ei3HQ42ySpr8KlIgt1Zble5qJUbIBfT9Z6m9eP4so0OOW7Ag9wBZyuLHkAKPdHHilA5vZZNZmI4bN00xdPGO2TzdLlRI1qDwGsBmOuJWDJKcgFQBnkKRzIw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786286793; c=relaxed/simple; bh=aDj5aLG7NStNslfYhTIl3YYv6XZgFNUFXK8u7qYzlf0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=p1uq5KKXhLKE2bNSMq45OIkteEkYzDolo4neDP8LtpJztHpWFyPQR9dHkz1uyRShmK1bZdEAHVDWCVBJjv0eQzRqPOtd/980O/MUlATdB7KPPnDcUIudT2sX+BNKsp5OMk0Sa6INxUqOu5CzrzGqc0kp3hTPaS7i7ZncD3DiSjU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Vlu1vdBh; arc=none smtp.client-ip=209.85.215.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Vlu1vdBh" Received: by mail-pg1-f176.google.com with SMTP id 41be03b00d2f7-ca7bea5e5b3so821093a12.1 for ; Sun, 09 Aug 2026 07:46:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786286792; x=1786891592; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=A3BeIAtfJ2/omVu82I5VMk45uIa8CTiHrIT/44X40ds=; b=Vlu1vdBhhJ5wFJxgLhLekISOcT8uuDAJbhlDFgUfFTBizj1mP1zUCnShcSFzbIr0mg TDpeLBMhZM4/G3CVcWW02fMGJW69l8/X8ANyhPlKlbRYt2RuPzBOGDcvDqGdZiOqKJIT StSKrGeMMfkeHA5cpIaLV87/IxrxUWgiKMPDT0VdTrUzMLyRYnr6XbirgK5B2EtBAo4I H4L/gTuMWu8QUQG87f3gWpjiAF0QZip4CHrf1WCPra+gyJW7lK75/ix61Y5escDxdFph 0pm3Z+uLZh1Vu9qvExHYpICwVlEtumuajvLhfQHlLWOuTQEWysKvtybnApjb+Mb3OMrY 6kaQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786286792; x=1786891592; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=A3BeIAtfJ2/omVu82I5VMk45uIa8CTiHrIT/44X40ds=; b=TU6u0Orp26KLl2HB63BL+RZo9RkFCEG4cQIlQa3ae0utUxMERiP/g9tuuGnXlpJeMD 5Uyt4jRBbY/lml65q9qf45FGoMBsIPO9GIGwIrTMIPk9VcDlY7zYVVbLhEcRmsB3+q9o ahi2ZbXW3DeuvzzS4OwNtLtZA9f+2q8YU5DfQyMpHBt2ZvmkBMh1JPL9TuImoo0oL4RN TZlP35wRf33ioGqCkG4fZyIrFUO1E5vkNqI9bTH2kvcMEw33jsJB+rcoOxxYZpc8YfCT gm2UC4zAVLiKKFM1eHBhO6Vt7JkfvgT5lugpbK7jxP9uhLzzB9l7VExY4EdNLZKqAwji mFjg== X-Forwarded-Encrypted: i=1; AHgh+RrX3AfF0bsutwtNj3PuOODEAVU3a6I90v5XKuL13JKJaaDptUnFPOnRTdymgFBIyznZB/wC4ZvMkWy67nM=@vger.kernel.org X-Gm-Message-State: AOJu0Yw0QHkhTXqTYsrront7u9Pt3R+xNs/9rQ3pDubf7lp5Yxx28UAz R96dFC6ZrVQqxEHJQnoL/lWeJKOdb3PpoekHkvxp92eIB+NadDD5yMQbG9Bjhm6o X-Gm-Gg: AR+sD13q1kUkfun+pv8EwyZH7ql/ji8zLKIWI+316aQsu9tWQqtdrH0TSlpdlikD6kE vMwYbPB8RpVQr5A7YK5dqDZqrUcphyYpt9c3QSmDktxcNfLPF7se4T+gRCNoGPB5VKtoanFGkPv +dWht+2lQLMt0UJsIeRMZILTyU6Ap1QbnbGqRHso4J2Ni9VTQ32B4bjmnHuuVHpKYv6glVnqY0U IIw/psRhcQYDGbWHYstk9kNQQh7woTSM4PYK1/OWv97jUUqmF8+EUZ2dI1k36vGHHulzD+ZoZKo U9jmPtE1Sap0bYG/uquluXUiO5eAH7pexD5WgyojmmmaPolQKTS9gL5CTENLUvnOYrQtgCwpgHC LzZLz5QfB+u85tGPOcwOxq8bNs/l41fX6TFepd3SyW26TnFVfLnMD1Jd/egc6fa9uO/mMcwDMyw 21gY1kA9jwpGaM6IZdb1Sv8qmzdgKcGMZO5Biu4xla3MZqLAH9RxpN3x1CXzHPD1lQZ0xVjm92A 2cnns4rHGLRhFV0aqzKjzM= X-Received: by 2002:a05:6a20:914b:b0:3c3:bbe6:95b1 with SMTP id adf61e73a8af0-3cb85eef9d6mr36805745637.24.1786286791895; Sun, 09 Aug 2026 07:46:31 -0700 (PDT) Received: from localhost.localdomain ([103.178.205.91]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-14101b7ad29sm25911224c88.13.2026.08.09.07.46.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Aug 2026 07:46:31 -0700 (PDT) From: Sreeraj S Kurup To: alexander.deucher@amd.com, christian.koenig@amd.com Cc: amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, airlied@gmail.com, simona@ffwll.ch, Sreeraj S Kurup Subject: [PATCH v5 1/4] drm/amdgpu/aca: Fix race condition and UAF in error cache logging Date: Sun, 9 Aug 2026 14:44:48 +0000 Message-ID: <20260809144451.35431-2-sreekuttan2156239@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260809144451.35431-1-sreekuttan2156239@gmail.com> References: <20260809144451.35431-1-sreekuttan2156239@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In aca_error_cache_log_bank_error(), find_bank_error() released aerr->lock prior to returning bank_error. This created a time-of-check to time-of-use (TOCTOU) race window where a concurrent caller of aca_log_aca_error() could acquire aerr->lock and free the bank_error node via aca_bank_error_remove(). When execution returned to aca_error_cache_log_bank_error(), incrementing bank_error->count resulted in a Use-After-Free and potential kernel memory corruption. Additionally, bank_error->count was updated outside mutex lock protection. Fix this by acquiring aerr->lock at the start of aca_error_cache_log_bank_error() and holding it continuously across lookup, creation, and counter updates, while removing redundant internal lock acquisitions in helper functions. Signed-off-by: Sreeraj S Kurup --- drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c b/drivers/gpu/drm/amd/= amdgpu/amdgpu_aca.c index db7858fe0c3d..d0d473082431 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c @@ -237,10 +237,8 @@ static struct aca_bank_error *new_bank_error(struct ac= a_error *aerr, struct aca_ INIT_LIST_HEAD(&bank_error->node); memcpy(&bank_error->info, info, sizeof(*info)); =20 - mutex_lock(&aerr->lock); list_add_tail(&bank_error->node, &aerr->list); aerr->nr_errors++; - mutex_unlock(&aerr->lock); =20 return bank_error; } @@ -249,22 +247,16 @@ static struct aca_bank_error *find_bank_error(struct = aca_error *aerr, struct aca { struct aca_bank_error *bank_error =3D NULL; struct aca_bank_info *tmp_info; - bool found =3D false; =20 - mutex_lock(&aerr->lock); list_for_each_entry(bank_error, &aerr->list, node) { tmp_info =3D &bank_error->info; if (tmp_info->socket_id =3D=3D info->socket_id && tmp_info->die_id =3D=3D info->die_id) { - found =3D true; - goto out_unlock; + return bank_error; } } =20 -out_unlock: - mutex_unlock(&aerr->lock); - - return found ? bank_error : NULL; + return NULL; } =20 static void aca_bank_error_remove(struct aca_error *aerr, struct aca_bank_= error *bank_error) @@ -306,11 +298,15 @@ int aca_error_cache_log_bank_error(struct aca_handle = *handle, struct aca_bank_in return 0; =20 aerr =3D &error_cache->errors[type]; + mutex_lock(&aerr->lock); bank_error =3D get_bank_error(aerr, info); - if (!bank_error) + if (!bank_error) { + mutex_unlock(&aerr->lock); return -ENOMEM; + } =20 bank_error->count +=3D count; + mutex_unlock(&aerr->lock); =20 return 0; } --=20 2.54.0 From nobody Tue Sep 29 09:47:00 2026 Received: from mail-pj1-f47.google.com (mail-pj1-f47.google.com [209.85.216.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EC37C264A97 for ; Sun, 9 Aug 2026 14:46:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.47 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786286807; cv=none; b=StEE7+uwXld4Dk6zUoAfW7GW/fisga5zYB1D2jC46iDs/UL6jOl1pABTEKiq5t7p3PpkagbrCBmM1MgDeU8jKcYnog8O7+hxnfQhQnt86pkEINmIUOuU48nbNnfxm9UP38uZuAk8OoLGd4LSYHzKIDUw/uxVsxZWlnsVLLY45Mg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786286807; c=relaxed/simple; bh=weRrChkTJgmtJ7e7uWxoKD+8+f+Z6NRdCPQ7Z7d8o5s=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=QTQJTNyEl98NI5q0hy6AJukBmYTjo9VUjIPbx9ivfpZj5XOl4A0aIDZl21S7gIoXC+i5aD5T+Lnp3zs8dDC/rWhUM2MjGTRgabVpsSFwHQXMVWFxHeHx4Hhj6/JKD5FJuT0UlJRYBRb8dSg77HnbdpuuMk4fg0G0/3e2fToZWqo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=BdlfavfA; arc=none smtp.client-ip=209.85.216.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="BdlfavfA" Received: by mail-pj1-f47.google.com with SMTP id 98e67ed59e1d1-38dc69c74b8so965165a91.0 for ; Sun, 09 Aug 2026 07:46:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786286805; x=1786891605; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=deoqn41jn4hqxaXBU0LER8gLC0cAyHmrQg56bcVPpQA=; b=BdlfavfAr5Q/EoL1nnX4pnzSVWlt+JSLfL7tjJa7sQgWVUKcUf6KJUGqcNUG1J8LJE RV/KEy2iTqdvSN+VvZObZ8uhfKsGP2ruydvtd1J/74tIZtuv6zBgu7ZLUulOIAbDUVr6 aWmwenfsB9GZVHDEPFxvDGrtbyKpg3iKxQ8/bIGVpQ7a+7DPDxHU5OxNuvhizxgqzqMT WOlEddDYLBOLPo1qREsfB2C2Dkx01JIlpKXufimAz2S+zG8zQH64dJNxshcelGiI6Rm0 7CUd14I5HOk/qG/TnanhNehUg6ZyedSQ4I9x3cehsuhJCUqGlNpFTfTZdqL4chdIwKH3 E15A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786286805; x=1786891605; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=deoqn41jn4hqxaXBU0LER8gLC0cAyHmrQg56bcVPpQA=; b=FKVyCx9rCF5rS5reYwWz5/W/4Ohg+v/mJRcUtuRW9wojQEQ/3ODkcVF6Mz0a+PWof+ Z0shtsto7ozlt1uQlt8fGHz6/UbABCpRn5Yux02d4hYnkIl4lf2qTeFWqFeLrHHp9ydn WEr69uQw+uKV6aCm97SXmoQKY5PzsT1eymKXmS0uK3BMgyaDlDSYECFbz37TQWnqMC2V mb20fqjaUnkX8m31Ukq/5YJ9nUbGmvHWQvWlwa/cBnhHv43dgkbka2iX3UMxffD5VeGS NKwFMxoy/Njey2knu9jHKl6ywzsnC8xtep+UN2XBALJm1NudXSbE44Qzn+jbtgbGvgMG 0sEg== X-Forwarded-Encrypted: i=1; AHgh+RpN1yWndaEKUDRSExhvjMRhiMtqxR1TPVZfE5Hb/v27MXo8fvV9HzPZdFBDSD7BhGCsPKn2dX8u3OgJ33o=@vger.kernel.org X-Gm-Message-State: AOJu0YxsZ//tRVGOfTvAmzb9Uz9m2IgSOeDqPFQitUxT3rgGk3VMcrD1 SRFnZMPPDFzgboQ3gfYc3pz/sqtrP3fbxe5EXqf+qZjwTZXmWMmGAKBA X-Gm-Gg: AR+sD10QjK8ttaafOwg2y9zzHZMaRP6bSMHKrOamhOfIHPwjqr8+X/DI+4tPUK6WuoW WKj4lZK3dXT7W6qbbmpuyV62QuwciQq7/2Eh0FY5EXEGDAEdEo7ZGk6OOBJa10Vd5VE+YMsAiR5 3cXzObNDixujHkK27Q3jH1UEPLV/q3zD1t7ozyvzli9VmgkrkbPKmdPoLqKQ4X9mDw5NMpnzMq5 UC11tk8oBoDRN3atwOoZ1aYeDTuNSwYwtAMRmL0IN1CQng1hVnCL8pE2z5LEAOSvL2PJFDGTNv5 26R+Jj8V9XNFAuUZRR0FK1+lbKCc7f4gte20PA/+3wljJysPpnYe+QGUwtHc6ri4vkB4Y0ZsOdn 6EUqZD+lADKTjwCpdruMJVt9VMnwQoj3yswqBoNOmWXQetWJo9ZSZUm/UdP2uSX4fh3AxAIryOu 8X0N2rpYZudmhLfuOb2Ctk25ii4/GxM+yGJ1ZM9qUztX16xGVwFlodklPmWj2GFdpV13Vnpf4JD DqbFWgKdAjqXKy1QChrHg== X-Received: by 2002:a17:90a:d010:b0:38d:eaec:4396 with SMTP id 98e67ed59e1d1-3903c58bdd2mr36617260a91.11.1786286805186; Sun, 09 Aug 2026 07:46:45 -0700 (PDT) Received: from localhost.localdomain ([103.178.205.91]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-14101b7ad29sm25911224c88.13.2026.08.09.07.46.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Aug 2026 07:46:44 -0700 (PDT) From: Sreeraj S Kurup To: alexander.deucher@amd.com, christian.koenig@amd.com Cc: amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, airlied@gmail.com, simona@ffwll.ch, Sreeraj S Kurup Subject: [PATCH v5 2/4] drm/amdgpu/aca: Add upper bounds check in aca_bank_hwip_is_matched Date: Sun, 9 Aug 2026 14:44:49 +0000 Message-ID: <20260809144451.35431-3-sreekuttan2156239@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260809144451.35431-1-sreekuttan2156239@gmail.com> References: <20260809144451.35431-1-sreekuttan2156239@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In aca_bank_hwip_is_matched(), the 'type' parameter is used directly as an array index into aca_hwid_mcatypes[]. The function previously checked whether 'type' was equal to ACA_HWIP_TYPE_UNKNOW, but did not validate whether 'type' was less than ACA_HWIP_TYPE_COUNT or negative. If an invalid or out-of-bounds enum value is passed, an out-of-bounds memory read occurs on the aca_hwid_mcatypes array. Fix this by validating that 'type' is strictly greater than ACA_HWIP_TYPE_UNKNOW and less than ACA_HWIP_TYPE_COUNT before performing the array lookup. Signed-off-by: Sreeraj S Kurup --- drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c b/drivers/gpu/drm/amd/= amdgpu/amdgpu_aca.c index d0d473082431..c76664af9902 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c @@ -138,7 +138,7 @@ static bool aca_bank_hwip_is_matched(struct aca_bank *b= ank, enum aca_hwip_type t int hwid, mcatype; u64 ipid; =20 - if (!bank || type =3D=3D ACA_HWIP_TYPE_UNKNOW) + if (!bank || type <=3D ACA_HWIP_TYPE_UNKNOW || type >=3D ACA_HWIP_TYPE_CO= UNT) return false; =20 hwip =3D &aca_hwid_mcatypes[type]; --=20 2.54.0 From nobody Tue Sep 29 09:47:00 2026 Received: from mail-pj1-f42.google.com (mail-pj1-f42.google.com [209.85.216.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A9C401A08AF for ; Sun, 9 Aug 2026 14:46:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.42 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786286816; cv=none; b=A0SMVD4X92wI7FcNSdFb9fIRClTJA7/s+ZOKPfOpo5BBAWj+TMyOPrlZ8fWSanrq/RTaYt0wGXTMi6a+tk7xLvgCdzJxvsFbKOLBZQOEuWp5l4n6YDGDkZBJQzmWnSbZhBIPtyV/60AydbZgsZw+mn7nHUgBk4k1Ve7NoHExen0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786286816; c=relaxed/simple; bh=MDHxZl9tGhMGw1h4Uupz4CF4eBZzJRhfIlV+oZU/nSw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=nfw0vvS8ES1IUVtWxLfS/Duo1HStsE1ZbXIrT4BIxWpw4ffXTiRfbm9M3yeRUNpa9w1R24HIFc0jol1R8EnVZIIW/W1QV+Dn8czvmW/Q+wR6FPh6FmKl2JYP48x/jH0cKzIj4J+WBq2RQ3+DzOtKOes8H0WUhcfOK6pPJSOy75Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=W5hgBm9O; arc=none smtp.client-ip=209.85.216.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="W5hgBm9O" Received: by mail-pj1-f42.google.com with SMTP id 98e67ed59e1d1-38dc69c74b8so965219a91.0 for ; Sun, 09 Aug 2026 07:46:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786286814; x=1786891614; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=DbPrDMI/UNfpgAnDfLZbZKEr3Nfo6jVgSwQlTScmMqI=; b=W5hgBm9OnhnmvrHTRFemJLmn87z9GnYuK6e8ULZfBumtPIgwCpX7+tx2oQ+5pbX30b quXfsnf51G5jTVqUZVa726AHpU+hRsCe8qC8anUHn00zMH6xLSuMEBljFIIXXazbTsrr IMwKkbnS5f4fG3F9J/uXpLkH/w6JEDPQeiTdwNPs6wFT0s1pyZvonE+Bb1sDKqPN8x+m PDtGf22VMBSfVnv4aSmHHJfLmsH/sCNIKZDxfqGw+T19H3tcT2CxW8NFBMTHw95yo9Bx OPBG/UrK7PLCyuml30n8pBGS/LjfJAHe+Pn2KtnreMet4zcOpDUqmNG4IHT5eeXQFveV kFgA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786286814; x=1786891614; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=DbPrDMI/UNfpgAnDfLZbZKEr3Nfo6jVgSwQlTScmMqI=; b=qeVbJmhC+17xt/kQb+plR9uY7k2jZ0K8Uf1mVFJd2EjgElw91Q/rhi7cykTXAwMwMg pT4rwMW7DagsX3ib2RhrmJFnC4exe4eg4c94H4pjHAGAm++zAEsbUA2g2vEDcvQZ75FR vK4MePdf2FNEsps1/sBzpJveCUTZEFART2U2oCp4dOyWnRAs+fv3QJ0Uw8+/Nrx1C48Q yYlehfDcJPD/WHFnzvKpQzrNjUaUxNmdRi4R+F/4ae2YbyDlubK7QLVCrcBrcVixos5P aHsHrEgS0Y8Cu/EiWz47JgVuQdQwnQorJBQOTUy42Vek0dxTuMhMIhhbWQsyltd1Mauu 6vog== X-Forwarded-Encrypted: i=1; AHgh+RogYzaYeIvh5k9ekiDmdgueL85enGQUkhAe6BTBZmLCVotyi2c3VmdqZUnM783ef3HyTpra94m5cXQlkqE=@vger.kernel.org X-Gm-Message-State: AOJu0YzR0X5Gker2O/odZviAim88U2NegU3fIaF4w+Id1lbsxWrSEd6T 7kva9vb3l2nz/m1/NnDoDmUrGj4KrsMpLl4Rq1MaGvzscf9GBhP3SL81 X-Gm-Gg: AR+sD10atnXETX7RDrgpkmpBvyewh6hn2HD+Ci1PxoP+Rbg3fsgp3KhKLW6TfMBiexT rBnIY0F9erO52jMSCO0k2SNPioHgv0/K8AM2Xwvpzhble05xMAJ1nVxQpknXgLSdDdV9v6tC3C7 RNJN3TDlwX5ADBc2WKQCCTk7vn49gN476AliCCUfZfOTQmShCNg/bCeVvU8lY/YPpE8prGL3tpO dqz/6FZkXlrZyUyA5XFNiBY/05MV2yF2ohFyVdEHC7+4PXAmnZAVlaNoILnWztKX1l0zprHXWwx 3clbBllbY7666Bq8JjfE4nIhdrxf97v7PDG5CqAsIsCR7LaKQyCcGvh8q6xknfvVopyUlKjRaTL AGuEX7NWtbTYCROUvY3ztcjk4B29s2mTpcTMAd1KJc1mW1ktvh10Ep6VJoowD5kV0WOwWaVfTAa 5OtYodVWHu3wXFpVDt2lt/0Mdo5LT9QzzqVaWL2WoKvfkip71aEyPIJRuhXtvSPhe8zBBQB8oCe JZ+gcWZ+Tk= X-Received: by 2002:a17:90b:4e8d:b0:381:cef1:11ac with SMTP id 98e67ed59e1d1-3903c58ed40mr36373724a91.10.1786286813705; Sun, 09 Aug 2026 07:46:53 -0700 (PDT) Received: from localhost.localdomain ([103.178.205.91]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-14101b7ad29sm25911224c88.13.2026.08.09.07.46.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Aug 2026 07:46:53 -0700 (PDT) From: Sreeraj S Kurup To: alexander.deucher@amd.com, christian.koenig@amd.com Cc: amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, airlied@gmail.com, simona@ffwll.ch, Sreeraj S Kurup Subject: [PATCH v5 3/4] drm/amdgpu/aca: Fix inverted validation logic and list cleanup Date: Sun, 9 Aug 2026 14:44:50 +0000 Message-ID: <20260809144451.35431-4-sreekuttan2156239@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260809144451.35431-1-sreekuttan2156239@gmail.com> References: <20260809144451.35431-1-sreekuttan2156239@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" "aca_handle_is_valid()" used inverted list-membership logic. It returned false when "!list_empty(&handle->node)" was true, even though a non-empty node indicates that the handle is currently registered. As a result, registered handles were incorrectly considered invalid. Fix "aca_handle_is_valid()" to verify that the handle is non-NULL, has a valid mask, and is currently registered in the handle list. Update "amdgpu_aca_get_error_data()" to reject invalid handles and return 0 rather than "-EOPNOTSUPP". This allows global RAS queries to safely skip non-ACA blocks without treating an unsupported block as an error. Additionally, use "list_del_init()" in "remove_aca_handle()" before "aca_fini_error_cache()". Unlike "list_del()", which poisons the removed node's pointers, "list_del_init()" reinitializes the node as an empty list. This ensures that "aca_handle_is_valid()" recognizes the handle as unregistered before its error cache is destroyed. Signed-off-by: Sreeraj S Kurup --- drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c b/drivers/gpu/drm/amd/= amdgpu/amdgpu_aca.c index c76664af9902..d48f2c4d6c84 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c @@ -586,10 +586,7 @@ static int __aca_get_error_data(struct amdgpu_device *= adev, struct aca_handle *h =20 static bool aca_handle_is_valid(struct aca_handle *handle) { - if (!handle->mask || !list_empty(&handle->node)) - return false; - - return true; + return handle && handle->mask && !list_empty(&handle->node); } =20 int amdgpu_aca_get_error_data(struct amdgpu_device *adev, struct aca_handl= e *handle, @@ -599,8 +596,8 @@ int amdgpu_aca_get_error_data(struct amdgpu_device *ade= v, struct aca_handle *han if (!handle || !err_data) return -EINVAL; =20 - if (aca_handle_is_valid(handle)) - return -EOPNOTSUPP; + if (!aca_handle_is_valid(handle)) + return 0; =20 if ((type < 0) || (!(BIT(type) & handle->mask))) return 0; @@ -716,9 +713,10 @@ static void remove_aca_handle(struct aca_handle *handl= e) { struct aca_handle_manager *mgr =3D handle->mgr; =20 - aca_fini_error_cache(handle); - list_del(&handle->node); + list_del_init(&handle->node); mgr->nr_handles--; + aca_fini_error_cache(handle); + } =20 static void remove_aca_sysfs(struct aca_handle *handle) --=20 2.54.0 From nobody Tue Sep 29 09:47:00 2026 Received: from mail-pj1-f49.google.com (mail-pj1-f49.google.com [209.85.216.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6B37929BDB1 for ; Sun, 9 Aug 2026 14:47:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.49 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786286821; cv=none; b=K6UE/XEsvxhYz4pBgzGpIKSH6yRBSQzlj8oauu8TRXvBoXJZLtDkjaue+TvAY7BSNUdSLfEcK1ExKkoZ6+M84a6ULKCcU38OP1WXfW3onVp7QhR397wKJTJWB/M2wEZ70ASpA2VCCWPCzOvbwsg7ycL8jEKtr4jAS/aG7wvsBnY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786286821; c=relaxed/simple; bh=mIys+3BFIDl7tB31cmwXr8lZBBTHD9rBn2NUuQBveAE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=iGn3G7LuX0vvWhWT2GQxgHSY15Aab1Fr3MOJ+WC6dZ4ULqkdr/9ZVmjapZQ1E5sWNt3g0erQxepWjWJWU8hAupObeZmaDMeEofYjoOzkOG8Ry6uoWXZLvbgt9vj6/Gum6iQAU9imQ2fLLBnZ8soZGiFnfCaLigcXorAw/rOSaDw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=QH72RjAS; arc=none smtp.client-ip=209.85.216.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="QH72RjAS" Received: by mail-pj1-f49.google.com with SMTP id 98e67ed59e1d1-38dc4553f62so1125709a91.0 for ; Sun, 09 Aug 2026 07:47:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786286820; x=1786891620; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=TTdDEO4C2pVqpnKnvMmpty/7Skli343KUkxbaW4hUmA=; b=QH72RjASmgyGLfpcJoGVgoD1VMiPS4TR1vPipyaLQHk3JlNVqqPOMlgUhfThD6hMYh okr4UCFVhXTwRmXcM9J6bbebw8K8r13lrsWdblJl7wI3JL/+nICRwmxk9WCHALK6QcOc IWjc0aANwNVZW74BClMx4L8fX2VGYOtXEJZu4CFNNM7m+YG5L2QLn/XSd9Hc4nWnrejv Uu56N6VKf56iEGIM0G4GTFZfqauEp/7MoPC0Y4u8CzBDHVxyZehUhvTjHbqgVH90eSvG YL9c4clwMu86DiuVt1Y5h/r7exr/joWQi5R/0MnvOw/ZmX0/oRyZythpFvZL30BDD4Pc EQXw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786286820; x=1786891620; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=TTdDEO4C2pVqpnKnvMmpty/7Skli343KUkxbaW4hUmA=; b=dA7ezyfYARuijvXlOHWeSulWM55zmQhKSsYyKXAvXF76kCAmsgX0HFUX+ZhtWeab1L apI8w2hN1ItTm8gSDQoWK+Mx3Qr1lrKcI4eRviWtV2GxZIsoEM2R9GPK/agTd9W0XaZA jhvilaUCCms+3R1iMWmjk8zNEiCln3hDZyr+rrPL1YJOO59d7botERfYYCfWQXv7FKs1 YjQ0xDLstlWeIiaslyCygsrQ0ReU3TcmVubj6XDuc1oels6uRv26Vsu0zzIgiNDxF/Tl vyps1KylD0E0hAS7QOmGjs+EswPZxq2ioyitpIRCt78ZvA0PfahF5duxPILn6NP6cTd5 IG4Q== X-Forwarded-Encrypted: i=1; AHgh+RpV0RfmrzPFP3azHZEGrIp8C1jVpDpitj1I8C7v6f95UBY61ZVqACPPIoOAiQfG3yey1fKI/Jl1Id0dH8I=@vger.kernel.org X-Gm-Message-State: AOJu0YwzHABvq3GHYfmaWCG0L+Mze/+yNy0kJlNGVDFoz7msh+7Al70b NOd0dGN6ztJVwMTFmDtpM2bwEW4UBtL4aq4WIhhA7wVKQbtK1qdlSUdc X-Gm-Gg: AR+sD13kBkLezqqYHiF3OuTPGhOT26atTSe7SMRwuNZQNYLFF0jTkm/jAydfWCYtTn0 rtapDtQ2XosThkhTJ/vFgReoHmYMy0/fOIhlu1en8NCV2NZ8zU2MywdlmH/oox9Duqt5nOJcINH QOCSwAl6iRJOlLNDOdyje+EcnHciR2v2vuhH93rB0hIeMbWVd7FqtIqzuuDaQ5LFEiuRjwm5yLo 7kidN3/mW3fu9o98WINGVW80EKPAA8TLAifdi7aufVrEchBMtpFj0u75bTP4uupSinL+jT4DsRf 4+OPyurA5F/QE9w7K+WnF/irL2LPttrGoRjdiiQR75ym3Y02SSOeUDFBeSTL5Qw+L8O3W7Rm9lV Pwf05B2pvlz/Rd7dmxt5uGBca0I0IyeTOcB5PmY/08XcLDdBHjKQF3bIMylsmbrRvbCJJsS6P6Z zJnBHDJEs/0RCXq38iPqhqUNU5e9WWGGWXTODycYkdaacbr14UnjW6ZbnF128JAF+zi1joVU9jD zJqBhjESfU= X-Received: by 2002:a17:90b:3889:b0:38f:57f0:1f5d with SMTP id 98e67ed59e1d1-3903c5c4491mr34362200a91.15.1786286819656; Sun, 09 Aug 2026 07:46:59 -0700 (PDT) Received: from localhost.localdomain ([103.178.205.91]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-14101b7ad29sm25911224c88.13.2026.08.09.07.46.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Aug 2026 07:46:59 -0700 (PDT) From: Sreeraj S Kurup To: alexander.deucher@amd.com, christian.koenig@amd.com Cc: amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, airlied@gmail.com, simona@ffwll.ch, Sreeraj S Kurup Subject: [PATCH v5 4/4] drm/amdgpu/ras: Fix delayed work cancellation order during teardown Date: Sun, 9 Aug 2026 14:44:51 +0000 Message-ID: <20260809144451.35431-5-sreekuttan2156239@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260809144451.35431-1-sreekuttan2156239@gmail.com> References: <20260809144451.35431-1-sreekuttan2156239@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In amdgpu_ras_recovery_fini(), mutex_destroy(&con->page_rsv_lock) was called prior to cancel_work_sync(&con->recovery_work) and cancel_delayed_work_sync(&con->page_retirement_dwork). If pending work ran during teardown, it could attempt to acquire page_rsv_lock after its destruction, leading to a locking violation and potential use-after-free. Fix this by moving cancel_work_sync(&con->recovery_work) and cancel_delayed_work_sync(&con->page_retirement_dwork) before mutex_destroy(&con->page_rsv_lock), ensuring both work items are synchronously canceled while the lock remains intact. Signed-off-by: Sreeraj S Kurup --- drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/= amdgpu/amdgpu_ras.c index 764cd4950408..1d6b4300d80a 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c @@ -3994,15 +3994,14 @@ static int amdgpu_ras_recovery_fini(struct amdgpu_d= evice *adev) if (con->page_retirement_thread) kthread_stop(con->page_retirement_thread); =20 + cancel_work_sync(&con->recovery_work); + cancel_delayed_work_sync(&con->page_retirement_dwork); + atomic_set(&con->page_retirement_req_cnt, 0); atomic_set(&con->poison_creation_count, 0); =20 mutex_destroy(&con->page_rsv_lock); =20 - cancel_work_sync(&con->recovery_work); - - cancel_delayed_work_sync(&con->page_retirement_dwork); - amdgpu_ras_ecc_log_fini(&con->umc_ecc_log); =20 mutex_lock(&con->recovery_lock); --=20 2.54.0