* [PATCH -next] drm/amdkfd: Fix NULL pointer dereference in svm_migrate_to_ram()
@ 2022-10-26 2:00 Yang Li
2022-10-26 20:37 ` Felix Kuehling
0 siblings, 1 reply; 4+ messages in thread
From: Yang Li @ 2022-10-26 2:00 UTC (permalink / raw)
To: Felix.Kuehling, alexander.deucher
Cc: christian.koenig, Xinhui.Pan, airlied, daniel, amd-gfx,
dri-devel, linux-kernel, Yang Li, Abaci Robot
./drivers/gpu/drm/amd/amdkfd/kfd_migrate.c:985:58-62: ERROR: p is NULL but dereferenced.
Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=2549
Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Signed-off-by: Yang Li <yang.lee@linux.alibaba.com>
---
change in v2:
According to Felix's suggestion, move the pr_debug up before the kfd_unref_process
call.
drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
index 20d6b2578927..b9c8d29d95aa 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
@@ -978,12 +978,10 @@ static vm_fault_t svm_migrate_to_ram(struct vm_fault *vmf)
out_unlock_svms:
mutex_unlock(&p->svms.lock);
out_unref_process:
+ pr_debug("CPU fault svms 0x%p address 0x%lx done\n", &p->svms, addr);
kfd_unref_process(p);
out_mmput:
mmput(mm);
-
- pr_debug("CPU fault svms 0x%p address 0x%lx done\n", &p->svms, addr);
-
return r ? VM_FAULT_SIGBUS : 0;
}
--
2.20.1.7.g153144c
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH -next] drm/amdkfd: Fix NULL pointer dereference in svm_migrate_to_ram()
2022-10-26 2:00 [PATCH -next] drm/amdkfd: Fix NULL pointer dereference in svm_migrate_to_ram() Yang Li
@ 2022-10-26 20:37 ` Felix Kuehling
0 siblings, 0 replies; 4+ messages in thread
From: Felix Kuehling @ 2022-10-26 20:37 UTC (permalink / raw)
To: Yang Li, alexander.deucher
Cc: christian.koenig, Xinhui.Pan, airlied, daniel, amd-gfx,
dri-devel, linux-kernel, Abaci Robot
On 2022-10-25 22:00, Yang Li wrote:
> ./drivers/gpu/drm/amd/amdkfd/kfd_migrate.c:985:58-62: ERROR: p is NULL but dereferenced.
>
> Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=2549
> Reported-by: Abaci Robot <abaci@linux.alibaba.com>
> Signed-off-by: Yang Li <yang.lee@linux.alibaba.com>
The patch is
Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
I applied to our amd-staging-drm-next branch.
Thanks,
Felix
> ---
>
> change in v2:
> According to Felix's suggestion, move the pr_debug up before the kfd_unref_process
> call.
>
> drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 4 +---
> 1 file changed, 1 insertion(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
> index 20d6b2578927..b9c8d29d95aa 100644
> --- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
> +++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
> @@ -978,12 +978,10 @@ static vm_fault_t svm_migrate_to_ram(struct vm_fault *vmf)
> out_unlock_svms:
> mutex_unlock(&p->svms.lock);
> out_unref_process:
> + pr_debug("CPU fault svms 0x%p address 0x%lx done\n", &p->svms, addr);
> kfd_unref_process(p);
> out_mmput:
> mmput(mm);
> -
> - pr_debug("CPU fault svms 0x%p address 0x%lx done\n", &p->svms, addr);
> -
> return r ? VM_FAULT_SIGBUS : 0;
> }
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH -next] drm/amdkfd: Fix NULL pointer dereference in svm_migrate_to_ram()
2022-10-25 7:28 Yang Li
@ 2022-10-25 19:39 ` Felix Kuehling
0 siblings, 0 replies; 4+ messages in thread
From: Felix Kuehling @ 2022-10-25 19:39 UTC (permalink / raw)
To: Yang Li, alexander.deucher
Cc: christian.koenig, Xinhui.Pan, airlied, daniel, amd-gfx,
dri-devel, linux-kernel, Abaci Robot
Am 2022-10-25 um 03:28 schrieb Yang Li:
> ./drivers/gpu/drm/amd/amdkfd/kfd_migrate.c:985:58-62: ERROR: p is NULL but dereferenced.
>
> Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=2549
> Reported-by: Abaci Robot <abaci@linux.alibaba.com>
> Signed-off-by: Yang Li <yang.lee@linux.alibaba.com>
> ---
> drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
> index cddf259875c0..405dd51521dc 100644
> --- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
> +++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
> @@ -981,7 +981,8 @@ static vm_fault_t svm_migrate_to_ram(struct vm_fault *vmf)
> out_mmput:
> mmput(mm);
>
> - pr_debug("CPU fault svms 0x%p address 0x%lx done\n", &p->svms, addr);
> + if (p)
> + pr_debug("CPU fault svms 0x%p address 0x%lx done\n", &p->svms, addr);
Thank you for catching and reporting this problem. I think the correct
solution would be to move the pr_debug up before the kfd_unref_process
call. That way you're sure that the pointer is initialized and that it
represents a valid reference to the kfd_process structure.
Regards,
Felix
>
> return r ? VM_FAULT_SIGBUS : 0;
> }
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH -next] drm/amdkfd: Fix NULL pointer dereference in svm_migrate_to_ram()
@ 2022-10-25 7:28 Yang Li
2022-10-25 19:39 ` Felix Kuehling
0 siblings, 1 reply; 4+ messages in thread
From: Yang Li @ 2022-10-25 7:28 UTC (permalink / raw)
To: alexander.deucher
Cc: Felix.Kuehling, christian.koenig, Xinhui.Pan, airlied, daniel,
amd-gfx, dri-devel, linux-kernel, Yang Li, Abaci Robot
./drivers/gpu/drm/amd/amdkfd/kfd_migrate.c:985:58-62: ERROR: p is NULL but dereferenced.
Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=2549
Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Signed-off-by: Yang Li <yang.lee@linux.alibaba.com>
---
drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
index cddf259875c0..405dd51521dc 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
@@ -981,7 +981,8 @@ static vm_fault_t svm_migrate_to_ram(struct vm_fault *vmf)
out_mmput:
mmput(mm);
- pr_debug("CPU fault svms 0x%p address 0x%lx done\n", &p->svms, addr);
+ if (p)
+ pr_debug("CPU fault svms 0x%p address 0x%lx done\n", &p->svms, addr);
return r ? VM_FAULT_SIGBUS : 0;
}
--
2.20.1.7.g153144c
^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-10-26 20:37 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-10-26 2:00 [PATCH -next] drm/amdkfd: Fix NULL pointer dereference in svm_migrate_to_ram() Yang Li
2022-10-26 20:37 ` Felix Kuehling
-- strict thread matches above, loose matches on Subject: below --
2022-10-25 7:28 Yang Li
2022-10-25 19:39 ` Felix Kuehling
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).