Commit 6665e13c authored by Philip Yang's avatar Philip Yang Committed by Kaixiong Yu
Browse files

drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer 

stable inclusion
from stable-v6.6.55
commit 30ceb873cc2e97348d9da2265b2d1ddf07f682e1
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRB0
CVE: CVE-2024-49991

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=30ceb873cc2e97348d9da2265b2d1ddf07f682e1



--------------------------------

[ Upstream commit c86ad39140bbcb9dc75a10046c2221f657e8083b ]

Pass pointer reference to amdgpu_bo_unref to clear the correct pointer,
otherwise amdgpu_bo_unref clear the local variable, the original pointer
not set to NULL, this could cause use-after-free bug.

Signed-off-by: default avatarPhilip Yang <Philip.Yang@amd.com>
Reviewed-by: default avatarFelix Kuehling <felix.kuehling@amd.com>
Acked-by: default avatarChristian König <christian.koenig@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarJinjiang Tu <tujinjiang@huawei.com>
parent 9809e40d

drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c

+7 −7
Original line number Diff line number Diff line
@@ -359,15 +359,15 @@ int amdgpu_amdkfd_alloc_gtt_mem(struct amdgpu_device *adev, size_t size, 
	return r;

}



void amdgpu_amdkfd_free_gtt_mem(struct amdgpu_device *adev, void *mem_obj)

void amdgpu_amdkfd_free_gtt_mem(struct amdgpu_device *adev, void **mem_obj)

{

	struct amdgpu_bo *bo = (struct amdgpu_bo *) mem_obj;

	struct amdgpu_bo **bo = (struct amdgpu_bo **) mem_obj;



	amdgpu_bo_reserve(bo, true);

	amdgpu_bo_kunmap(bo);

	amdgpu_bo_unpin(bo);

	amdgpu_bo_unreserve(bo);

	amdgpu_bo_unref(&(bo));

	amdgpu_bo_reserve(*bo, true);

	amdgpu_bo_kunmap(*bo);

	amdgpu_bo_unpin(*bo);

	amdgpu_bo_unreserve(*bo);

	amdgpu_bo_unref(bo);

}



int amdgpu_amdkfd_alloc_gws(struct amdgpu_device *adev, size_t size,

drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h

+1 −1
Original line number Diff line number Diff line
@@ -228,7 +228,7 @@ int amdgpu_amdkfd_evict_userptr(struct mmu_interval_notifier *mni, 
int amdgpu_amdkfd_alloc_gtt_mem(struct amdgpu_device *adev, size_t size,

				void **mem_obj, uint64_t *gpu_addr,

				void **cpu_ptr, bool mqd_gfx9);

void amdgpu_amdkfd_free_gtt_mem(struct amdgpu_device *adev, void *mem_obj);

void amdgpu_amdkfd_free_gtt_mem(struct amdgpu_device *adev, void **mem_obj);

int amdgpu_amdkfd_alloc_gws(struct amdgpu_device *adev, size_t size,

				void **mem_obj);

void amdgpu_amdkfd_free_gws(struct amdgpu_device *adev, void *mem_obj);

drivers/gpu/drm/amd/amdkfd/kfd_chardev.c

+1 −1
Original line number Diff line number Diff line
@@ -417,7 +417,7 @@ static int kfd_ioctl_create_queue(struct file *filep, struct kfd_process *p, 


err_create_queue:

	if (wptr_bo)

		amdgpu_amdkfd_free_gtt_mem(dev->adev, wptr_bo);

		amdgpu_amdkfd_free_gtt_mem(dev->adev, (void **)&wptr_bo);

err_wptr_map_gart:

err_bind_process:

err_pdd:

drivers/gpu/drm/amd/amdkfd/kfd_device.c

+2 −2
Original line number Diff line number Diff line
@@ -838,7 +838,7 @@ bool kgd2kfd_device_init(struct kfd_dev *kfd, 
kfd_doorbell_error:

	kfd_gtt_sa_fini(kfd);

kfd_gtt_sa_init_error:

	amdgpu_amdkfd_free_gtt_mem(kfd->adev, kfd->gtt_mem);

	amdgpu_amdkfd_free_gtt_mem(kfd->adev, &kfd->gtt_mem);

alloc_gtt_mem_failure:

	dev_err(kfd_device,

		"device %x:%x NOT added due to errors\n",
@@ -856,7 +856,7 @@ void kgd2kfd_device_exit(struct kfd_dev *kfd) 
		kfd_doorbell_fini(kfd);

		ida_destroy(&kfd->doorbell_ida);

		kfd_gtt_sa_fini(kfd);

		amdgpu_amdkfd_free_gtt_mem(kfd->adev, kfd->gtt_mem);

		amdgpu_amdkfd_free_gtt_mem(kfd->adev, &kfd->gtt_mem);

	}



	kfree(kfd);

drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c

+1 −1
Original line number Diff line number Diff line
@@ -2610,7 +2610,7 @@ static void deallocate_hiq_sdma_mqd(struct kfd_node *dev, 
{

	WARN(!mqd, "No hiq sdma mqd trunk to free");



	amdgpu_amdkfd_free_gtt_mem(dev->adev, mqd->gtt_mem);

	amdgpu_amdkfd_free_gtt_mem(dev->adev, &mqd->gtt_mem);

}



void device_queue_manager_uninit(struct device_queue_manager *dqm)