amdgpu_gem_ualink_handle_ioctl() dereferences adev->ualink.info before
validating it, but that structure is only allocated when the UALink IP
block is present, which is currently added only for GFX 12.1 only. The
ioctl is registered for every amdgpu device with DRM_RENDER_ALLOW, so
on any other ASIC a render node user can oops the kernel with a single
call.
Return -EOPNOTSUPP when the UALink software state is absent.
Fixes: 8a8bb5cb0410 ("drm/amdgpu: Add ioctl infra for exporting/importing
UALink handles")
Reported-by: Sashiko-bot <[email protected]>
Signed-off-by: Mukul Joshi <[email protected]>
Reviewed-by: Felix Kuehling <[email protected]>
---
v1->v2:
- Updated the failure message.
drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c
b/drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c
index 8411ea17172f..d55570d083f7 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c
@@ -4072,10 +4072,15 @@ int amdgpu_gem_ualink_handle_ioctl(struct drm_device
*dev, void *data,
u32 gem_handle;
int r, fd = -1;
- if (adev->ualink.info->accel_state !=
- AMDGPU_UALINK_ACCEL_STATE_ACTIVE) {
- dev_err(adev->dev,
- "ualink device is not in active state in vpod\n");
+ /* The ioctl is registered for every amdgpu device, but the UALink
+ * software state only exists on ASICs that instantiate the UALink IP
+ * block. Bail out if it is absent, and short-circuit before the
+ * accel_state dereference below.
+ */
+ if (!adev->ualink.info ||
+ adev->ualink.info->accel_state != AMDGPU_UALINK_ACCEL_STATE_ACTIVE)
{
+ dev_dbg(adev->dev,
+ "ualink device not available or not in active state\n");
return -EOPNOTSUPP;
}
--
2.55.0
