This patch series addresses several race conditions, boundary check
bugs, logic inversions, NULL pointer checks, and buffer size
parameters across the AMDGPU ACA (Accelerated Compute Architecture)
and RAS driver subsystems.
v3 -> v4:
- Patch 3: Wrapped list_del_init() inside mgr->lock in
remove_aca_handle() and moved node unlinking prior to
aca_fini_error_cache(). This prevents infinite loops during
concurrent list traversal and stops background queries from
referencing destroyed error cache mutexes during teardown.
- Patch 6: Updated subject and moved cancel_work_sync() and
cancel_delayed_work_sync() prior to
mutex_destroy(&con->page_rsv_lock) in amdgpu_ras_recovery_fini()
to prevent work executing after lock destruction.
v2 -> v3:
- Patch 3: Updated amdgpu_aca_get_error_data() to return 0 instead
of -EOPNOTSUPP for invalid handles, ensuring global RAS error
queries safely pass through non-ACA blocks without breaking
telemetry.
- Patch 6: Moved cancel_delayed_work_sync() in amdgpu_ras_fini()
prior to ACA subsystem and lock cleanup to avoid teardown races
and UAF.
v1 -> v2:
- Patch 3: Updated remove_aca_handle() to use list_del_init()
instead of list_del(), ensuring list_empty() properly evaluates
removed handles and avoiding potential UAF during device
teardown.
Sreeraj S Kurup (6):
drm/amdgpu/aca: Fix race condition and UAF in error cache logging
drm/amdgpu/aca: Add upper bounds check in aca_bank_hwip_is_matched
drm/amdgpu/aca: Fix inverted validation logic and list cleanup
drm/amdgpu/aca: Add missing NULL check for banks parameter in
aca_banks_add_bank
drm/amdgpu/aca: Fix off-by-one buffer size parameter in add_aca_sysfs
drm/amdgpu/ras: Fix delayed work cancellation order during teardown
drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 41 ++++++++++++-------------
drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 11 +++----
2 files changed, 24 insertions(+), 28 deletions(-)
--
2.54.0
