This patch series addresses several race conditions, boundary check bugs,
logic inversions, NULL pointer checks, and buffer size parameters across
the AMDGPU ACA (Accelerated Compute Architecture) and RAS driver
subsystems.
v2 -> v3:
- Patch 3: Updated amdgpu_aca_get_error_data() to return 0 instead of
-EOPNOTSUPP for invalid handles, ensuring global RAS error queries
safely pass through non-ACA blocks without breaking telemetry.
- Patch 6: Moved cancel_delayed_work_sync() in amdgpu_ras_fini() prior to
ACA subsystem and lock cleanup to avoid teardown races and UAF.
v1 -> v2:
- Patch 3: Updated remove_aca_handle() to use list_del_init() instead
of list_del(), ensuring list_empty() properly evaluates removed
handles and avoiding potential UAF during device teardown.
Sreeraj S Kurup (6):
drm/amdgpu/aca: Fix race condition and UAF in error cache logging
drm/amdgpu/aca: Add upper bounds check in aca_bank_hwip_is_matched
drm/amdgpu/aca: Fix inverted validation logic and list cleanup
drm/amdgpu/aca: Add missing NULL check for banks parameter in
aca_banks_add_bank
drm/amdgpu/aca: Fix off-by-one buffer size parameter in add_aca_sysfs
drm/amdgpu/ras: Cancel delayed work before ACA teardown in
amdgpu_ras_fini
drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 35 ++++++++++---------------
drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 3 +--
2 files changed, 15 insertions(+), 23 deletions(-)
--
2.54.0
