Five independent fixes; no dependency between them, they can be applied or dropped individually.
Patch 1 frees fpriv->prt_va on the amdgpu_driver_open_kms() error path. amdgpu_vm_fini() releases mappings but never a struct amdgpu_bo_va, so a failure to map the CSA or the seq64 buffer leaks the bo_va and the dma_fence stub reference it holds. postclose_kms() already gets this right; only the open() unwind was missing it. Patch 2 rejects a mapping without a backing BO in amdgpu_userq_input_va_validate(). A PRT mapping is routed through fpriv->prt_va, whose base.bo is NULL, yet a queue_va/rptr_va/wptr_va inside it passes validation and latches userq_va_mapped. The next unmap of any PRT mapping in that VM then dereferences bo_va->base.bo in amdgpu_userq_gem_va_unmap_validate(). Patch 3 bounds the retry loop in amdgpu_userq_ensure_ev_fence(). Every failure ahead of amdgpu_evf_mgr_rearm() leaves the restore worker giving up with only a drm_file_err(), so the waiting thread reschedules and flushes forever in TASK_UNINTERRUPTIBLE - unkillable and out of reach of the OOM killer. The eviction fence sequence number is used as the loop's progress condition instead. Patch 4 applies the decode arm's handle ownership test to the UVD destroy arm. handles[] and filp[] are per-device, and destroy clears every slot matching the handle from the command stream without checking the owner, so one render node client can tear down another's UVD session and leave a stale filp behind. Patch 5 releases the userptr HMM ranges in amdgpu_cs_parser_fini(). amdgpu_cs_parser_bos() returns with them live and only two sites free them; every error edge in between leaks a struct amdgpu_hmm_range plus a kvmalloc_array() of one hmm_pfn per page of the userptr mapping, allocated GFP_KERNEL and not charged to the caller's memcg. An IB address with no VM mapping is enough to reach one of those edges, so it is repeatable at will from an unprivileged fd. Signed-off-by: Junrui Luo <[email protected]> --- Junrui Luo (5): drm/amdgpu: free prt_va on the open_kms error path drm/amdgpu: reject PRT mappings as user queue buffer VAs drm/amdgpu/userq: bound the eviction fence rearm retry loop drm/amdgpu: enforce UVD handle ownership on destroy drm/amdgpu: free userptr HMM ranges on the CS error path drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 10 +++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 5 +++++ drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 29 +++++++++++++++++++++++-- drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h | 4 ++-- drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c | 10 ++++++++- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 14 ++++++++++-- 6 files changed, 65 insertions(+), 7 deletions(-) --- base-commit: c4f76bf5e107bcda6e496f1c4060c55af091fa79 change-id: 20260810-amdgpu-fixes-b6ab1059a034 Best regards, -- Junrui Luo <[email protected]>
