Commit 5d818e57 authored by Philip Yang's avatar Philip Yang Committed by Kaixiong Yu
Browse files

drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer 

mainline inclusion
from mainline-v6.12-rc1
commit c86ad39140bbcb9dc75a10046c2221f657e8083b
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRB0
CVE: CVE-2024-49991

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c86ad39140bbcb9dc75a10046c2221f657e8083b



--------------------------------

Pass pointer reference to amdgpu_bo_unref to clear the correct pointer,
otherwise amdgpu_bo_unref clear the local variable, the original pointer
not set to NULL, this could cause use-after-free bug.

Signed-off-by: default avatarPhilip Yang <Philip.Yang@amd.com>
Reviewed-by: default avatarFelix Kuehling <felix.kuehling@amd.com>
Acked-by: default avatarChristian König <christian.koenig@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>

Conflicts:
	drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
	drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
	drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
	drivers/gpu/drm/amd/amdkfd/kfd_device.c
	drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
	drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c
	drivers/gpu/drm/amd/amdkfd/kfd_process.c
	drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
	drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
[Context conflicts due to 6bfc7c7e ("drm/amdkfd: replace kgd_dev in
various amgpu_amdkfd funcs") isn't merged, and several
amdgpu_amdkfd_free_gtt_mem() aren't introduced.]
Signed-off-by: default avatarJinjiang Tu <tujinjiang@huawei.com>
parent 929a9df3

drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c

+7 −7
Original line number Diff line number Diff line
@@ -310,15 +310,15 @@ int amdgpu_amdkfd_alloc_gtt_mem(struct kgd_dev *kgd, size_t size, 
	return r;

}



void amdgpu_amdkfd_free_gtt_mem(struct kgd_dev *kgd, void *mem_obj)

void amdgpu_amdkfd_free_gtt_mem(struct kgd_dev *kgd, void **mem_obj)

{

	struct amdgpu_bo *bo = (struct amdgpu_bo *) mem_obj;

	struct amdgpu_bo **bo = (struct amdgpu_bo **) mem_obj;



	amdgpu_bo_reserve(bo, true);

	amdgpu_bo_kunmap(bo);

	amdgpu_bo_unpin(bo);

	amdgpu_bo_unreserve(bo);

	amdgpu_bo_unref(&(bo));

	amdgpu_bo_reserve(*bo, true);

	amdgpu_bo_kunmap(*bo);

	amdgpu_bo_unpin(*bo);

	amdgpu_bo_unreserve(*bo);

	amdgpu_bo_unref(bo);

}



int amdgpu_amdkfd_alloc_gws(struct kgd_dev *kgd, size_t size,

drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h

+1 −1
Original line number Diff line number Diff line
@@ -183,7 +183,7 @@ int amdgpu_amdkfd_evict_userptr(struct kgd_mem *mem, struct mm_struct *mm) 
int amdgpu_amdkfd_alloc_gtt_mem(struct kgd_dev *kgd, size_t size,

				void **mem_obj, uint64_t *gpu_addr,

				void **cpu_ptr, bool mqd_gfx9);

void amdgpu_amdkfd_free_gtt_mem(struct kgd_dev *kgd, void *mem_obj);

void amdgpu_amdkfd_free_gtt_mem(struct kgd_dev *kgd, void **mem_obj);

int amdgpu_amdkfd_alloc_gws(struct kgd_dev *kgd, size_t size, void **mem_obj);

void amdgpu_amdkfd_free_gws(struct kgd_dev *kgd, void *mem_obj);

int amdgpu_amdkfd_add_gws_to_process(void *info, void *gws, struct kgd_mem **mem);

drivers/gpu/drm/amd/amdkfd/kfd_device.c

+2 −2
Original line number Diff line number Diff line
@@ -782,7 +782,7 @@ bool kgd2kfd_device_init(struct kfd_dev *kfd, 
kfd_doorbell_error:

	kfd_gtt_sa_fini(kfd);

kfd_gtt_sa_init_error:

	amdgpu_amdkfd_free_gtt_mem(kfd->kgd, kfd->gtt_mem);

	amdgpu_amdkfd_free_gtt_mem(kfd->kgd, &kfd->gtt_mem);

alloc_gtt_mem_failure:

	if (kfd->gws)

		amdgpu_amdkfd_free_gws(kfd->kgd, kfd->gws);
@@ -803,7 +803,7 @@ void kgd2kfd_device_exit(struct kfd_dev *kfd) 
		kfd_doorbell_fini(kfd);

		ida_destroy(&kfd->doorbell_ida);

		kfd_gtt_sa_fini(kfd);

		amdgpu_amdkfd_free_gtt_mem(kfd->kgd, kfd->gtt_mem);

		amdgpu_amdkfd_free_gtt_mem(kfd->kgd, &kfd->gtt_mem);

		if (kfd->gws)

			amdgpu_amdkfd_free_gws(kfd->kgd, kfd->gws);

	}

drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c

+1 −1
Original line number Diff line number Diff line
@@ -1971,7 +1971,7 @@ static void deallocate_hiq_sdma_mqd(struct kfd_dev *dev, 
{

	WARN(!mqd, "No hiq sdma mqd trunk to free");



	amdgpu_amdkfd_free_gtt_mem(dev->kgd, mqd->gtt_mem);

	amdgpu_amdkfd_free_gtt_mem(dev->kgd, &mqd->gtt_mem);

}



void device_queue_manager_uninit(struct device_queue_manager *dqm)

drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c

+1 −1
Original line number Diff line number Diff line
@@ -293,7 +293,7 @@ static void free_mqd(struct mqd_manager *mm, void *mqd, 
	struct kfd_dev *kfd = mm->dev;



	if (mqd_mem_obj->gtt_mem) {

		amdgpu_amdkfd_free_gtt_mem(kfd->kgd, mqd_mem_obj->gtt_mem);

		amdgpu_amdkfd_free_gtt_mem(kfd->kgd, &mqd_mem_obj->gtt_mem);

		kfree(mqd_mem_obj);

	} else {

		kfd_gtt_sa_free(mm->dev, mqd_mem_obj);