| From c47273c702f75206d5c4d7b1eef18c4678a3a5a5 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 18 May 2021 10:56:07 +0800 |
| Subject: drm/amdgpu: Fix a use-after-free |
| MIME-Version: 1.0 |
| Content-Type: text/plain; charset=UTF-8 |
| Content-Transfer-Encoding: 8bit |
| |
| From: xinhui pan <xinhui.pan@amd.com> |
| |
| [ Upstream commit 1e5c37385097c35911b0f8a0c67ffd10ee1af9a2 ] |
| |
| looks like we forget to set ttm->sg to NULL. |
| Hit panic below |
| |
| [ 1235.844104] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b7b4b: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI |
| [ 1235.989074] Call Trace: |
| [ 1235.991751] sg_free_table+0x17/0x20 |
| [ 1235.995667] amdgpu_ttm_backend_unbind.cold+0x4d/0xf7 [amdgpu] |
| [ 1236.002288] amdgpu_ttm_backend_destroy+0x29/0x130 [amdgpu] |
| [ 1236.008464] ttm_tt_destroy+0x1e/0x30 [ttm] |
| [ 1236.013066] ttm_bo_cleanup_memtype_use+0x51/0xa0 [ttm] |
| [ 1236.018783] ttm_bo_release+0x262/0xa50 [ttm] |
| [ 1236.023547] ttm_bo_put+0x82/0xd0 [ttm] |
| [ 1236.027766] amdgpu_bo_unref+0x26/0x50 [amdgpu] |
| [ 1236.032809] amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x7aa/0xd90 [amdgpu] |
| [ 1236.040400] kfd_ioctl_alloc_memory_of_gpu+0xe2/0x330 [amdgpu] |
| [ 1236.046912] kfd_ioctl+0x463/0x690 [amdgpu] |
| |
| Signed-off-by: xinhui pan <xinhui.pan@amd.com> |
| Reviewed-by: Christian Kรถnig <christian.koenig@amd.com> |
| Signed-off-by: Alex Deucher <alexander.deucher@amd.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 1 + |
| 1 file changed, 1 insertion(+) |
| |
| diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c |
| index 7271e3f32d82..ab041ae58b20 100644 |
| --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c |
| +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c |
| @@ -886,6 +886,7 @@ static void amdgpu_ttm_tt_unpopulate(struct ttm_tt *ttm) |
| |
| if (gtt && gtt->userptr) { |
| kfree(ttm->sg); |
| + ttm->sg = NULL; |
| ttm->page_flags &= ~TTM_PAGE_FLAG_SG; |
| return; |
| } |
| -- |
| 2.30.2 |
| |
