* [PATCH Reivew 1/1] drm/amdgpu: fix use-after-free during gpu recovery
@ 2022-11-17 3:00 Stanley.Yang
2022-11-21 2:47 ` Zhou1, Tao
0 siblings, 1 reply; 2+ messages in thread
From: Stanley.Yang @ 2022-11-17 3:00 UTC (permalink / raw)
To: amd-gfx; +Cc: YuBiao.Wang, andrey.grodzovsky, Stanley.Yang
[Why]
[ 754.862560] refcount_t: underflow; use-after-free.
[ 754.862898] Call Trace:
[ 754.862903] <TASK>
[ 754.862913] amdgpu_job_free_cb+0xc2/0xe1 [amdgpu]
[ 754.863543] drm_sched_main.cold+0x34/0x39 [amd_sched]
[How]
The fw_fence may be not init, check whether dma_fence_init
is performed before job free
Signed-off-by: Stanley.Yang <Stanley.Yang@amd.com>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
index 8771df97d590..ddee6a6b133d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
@@ -169,7 +169,11 @@ static void amdgpu_job_free_cb(struct drm_sched_job *s_job)
amdgpu_sync_free(&job->sync);
amdgpu_sync_free(&job->sched_sync);
- dma_fence_put(&job->hw_fence);
+ /* only put the hw fence if has embedded fence */
+ if (!job->hw_fence.ops)
+ kfree(job);
+ else
+ dma_fence_put(&job->hw_fence);
}
void amdgpu_job_set_gang_leader(struct amdgpu_job *job,
--
2.17.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* RE: [PATCH Reivew 1/1] drm/amdgpu: fix use-after-free during gpu recovery
2022-11-17 3:00 [PATCH Reivew 1/1] drm/amdgpu: fix use-after-free during gpu recovery Stanley.Yang
@ 2022-11-21 2:47 ` Zhou1, Tao
0 siblings, 0 replies; 2+ messages in thread
From: Zhou1, Tao @ 2022-11-21 2:47 UTC (permalink / raw)
To: Yang, Stanley, amd-gfx; +Cc: Wang, YuBiao, andrey.grodzovsky, Yang, Stanley
[AMD Official Use Only - General]
Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
> -----Original Message-----
> From: amd-gfx <amd-gfx-bounces@lists.freedesktop.org> On Behalf Of
> Stanley.Yang
> Sent: Thursday, November 17, 2022 11:01 AM
> To: amd-gfx@lists.freedesktop.org
> Cc: Wang, YuBiao <YuBiao.Wang@amd.com>; andrey.grodzovsky@amd.com;
> Yang, Stanley <Stanley.Yang@amd.com>
> Subject: [PATCH Reivew 1/1] drm/amdgpu: fix use-after-free during gpu
> recovery
>
> [Why]
> [ 754.862560] refcount_t: underflow; use-after-free.
> [ 754.862898] Call Trace:
> [ 754.862903] <TASK>
> [ 754.862913] amdgpu_job_free_cb+0xc2/0xe1 [amdgpu]
> [ 754.863543] drm_sched_main.cold+0x34/0x39 [amd_sched]
>
> [How]
> The fw_fence may be not init, check whether dma_fence_init
> is performed before job free
>
> Signed-off-by: Stanley.Yang <Stanley.Yang@amd.com>
> ---
> drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
> b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
> index 8771df97d590..ddee6a6b133d 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
> @@ -169,7 +169,11 @@ static void amdgpu_job_free_cb(struct drm_sched_job
> *s_job)
> amdgpu_sync_free(&job->sync);
> amdgpu_sync_free(&job->sched_sync);
>
> - dma_fence_put(&job->hw_fence);
> + /* only put the hw fence if has embedded fence */
> + if (!job->hw_fence.ops)
> + kfree(job);
> + else
> + dma_fence_put(&job->hw_fence);
> }
>
> void amdgpu_job_set_gang_leader(struct amdgpu_job *job,
> --
> 2.17.1
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-11-21 2:47 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-11-17 3:00 [PATCH Reivew 1/1] drm/amdgpu: fix use-after-free during gpu recovery Stanley.Yang
2022-11-21 2:47 ` Zhou1, Tao
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.