This patch series addresses race conditions, boundary check bugs, logic
inversions, and teardown ordering in the AMDGPU ACA (Accelerated Compute
Architecture) and RAS driver subsystems.
v4 -> v5:
- Dropped former Patch 4 (NULL check on banks parameter) and Patch 5
(snprintf buffer size adjustment) from v5.
- Patch 3: Dropped invalid kfree(handle) from remove_aca_handle()
since ACA handles can be embedded in ras_manager. Removed non-existent
mgr->lock references and retained list_del_init() prior to
aca_fini_error_cache().
- Patch 4 (formerly Patch 6): Retained the original work cancellation
order in amdgpu_ras_fini() to prevent work re-queueing, while moving
cancellation prior to mutex_destroy(&con->page_rsv_lock) in
amdgpu_ras_recovery_fini().
v3 -> v4:
- Patch 3: Moved node unlinking prior to aca_fini_error_cache().
- Patch 4 (formerly Patch 6): Updated the subject and moved
cancel_work_sync() and cancel_delayed_work_sync() prior to
mutex_destroy(&con->page_rsv_lock) in amdgpu_ras_recovery_fini().
v2 -> v3:
- Patch 3: Updated amdgpu_aca_get_error_data() to return 0 instead
of -EOPNOTSUPP for invalid handles, allowing global RAS error
queries to safely pass through non-ACA blocks.
v1 -> v2:
- Patch 3: Updated remove_aca_handle() to use list_del_init()
instead of list_del(), ensuring list_empty() correctly evaluates
removed handles.
Sreeraj S Kurup (4):
drm/amdgpu/aca: Fix race condition and UAF in error cache logging
drm/amdgpu/aca: Add upper bounds check in aca_bank_hwip_is_matched
drm/amdgpu/aca: Fix inverted validation logic and list cleanup
drm/amdgpu/ras: Fix delayed work cancellation order during teardown
drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 34 ++++++++++---------------
drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 7 +++--
2 files changed, 17 insertions(+), 24 deletions(-)
--
2.54.0
