drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer

[ Upstream commit c86ad39140bbcb9dc75a10046c2221f657e8083b ]

Pass pointer reference to amdgpu_bo_unref to clear the correct pointer,
otherwise amdgpu_bo_unref clear the local variable, the original pointer
not set to NULL, this could cause use-after-free bug.

Signed-off-by: Philip Yang <Philip.Yang@amd.com>
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Acked-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
index e3738d4172458c3a034d2f343595cdb5c84bdca1..26ecca3e8e9003a9789c62a3dea30f0ce8f1e457 100644 (file)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
@@ -360,15 +360,15 @@ allocate_mem_reserve_bo_failed:
        return r;
 }
 
-void amdgpu_amdkfd_free_gtt_mem(struct amdgpu_device *adev, void *mem_obj)
+void amdgpu_amdkfd_free_gtt_mem(struct amdgpu_device *adev, void **mem_obj)
 {
-       struct amdgpu_bo *bo = (struct amdgpu_bo *) mem_obj;
+       struct amdgpu_bo **bo = (struct amdgpu_bo **) mem_obj;
 
-       amdgpu_bo_reserve(bo, true);
-       amdgpu_bo_kunmap(bo);
-       amdgpu_bo_unpin(bo);
-       amdgpu_bo_unreserve(bo);
-       amdgpu_bo_unref(&(bo));
+       amdgpu_bo_reserve(*bo, true);
+       amdgpu_bo_kunmap(*bo);
+       amdgpu_bo_unpin(*bo);
+       amdgpu_bo_unreserve(*bo);
+       amdgpu_bo_unref(bo);
 }
 
 int amdgpu_amdkfd_alloc_gws(struct amdgpu_device *adev, size_t size,

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
index 1de021ebdd467b5dcb270cab41314f462333a20a..ee16d8a9ba559625ddc567f909d10ddaf3e69af7 100644 (file)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
@@ -233,7 +233,7 @@ int amdgpu_amdkfd_bo_validate_and_fence(struct amdgpu_bo *bo,
 int amdgpu_amdkfd_alloc_gtt_mem(struct amdgpu_device *adev, size_t size,
                                void **mem_obj, uint64_t *gpu_addr,
                                void **cpu_ptr, bool mqd_gfx9);
-void amdgpu_amdkfd_free_gtt_mem(struct amdgpu_device *adev, void *mem_obj);
+void amdgpu_amdkfd_free_gtt_mem(struct amdgpu_device *adev, void **mem_obj);
 int amdgpu_amdkfd_alloc_gws(struct amdgpu_device *adev, size_t size,
                                void **mem_obj);
 void amdgpu_amdkfd_free_gws(struct amdgpu_device *adev, void *mem_obj);

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index fdf171ad4a3c6b5b293e691a0baa7269a0de0705..4f260adce8c463ca58d26c274636a63ac3298a42 100644 (file)
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -423,7 +423,7 @@ static int kfd_ioctl_create_queue(struct file *filep, struct kfd_process *p,
 
 err_create_queue:
        if (wptr_bo)
-               amdgpu_amdkfd_free_gtt_mem(dev->adev, wptr_bo);
+               amdgpu_amdkfd_free_gtt_mem(dev->adev, (void **)&wptr_bo);
 err_wptr_map_gart:
 err_bind_process:
 err_pdd:

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
index afc57df421cd9c4d3bf2fb52b56bdfe0d3227afe..3343079f28c9032ff1c827dc42d0f0146d303b82 100644 (file)
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
@@ -863,7 +863,7 @@ node_alloc_error:
 kfd_doorbell_error:
        kfd_gtt_sa_fini(kfd);
 kfd_gtt_sa_init_error:
-       amdgpu_amdkfd_free_gtt_mem(kfd->adev, kfd->gtt_mem);
+       amdgpu_amdkfd_free_gtt_mem(kfd->adev, &kfd->gtt_mem);
 alloc_gtt_mem_failure:
        dev_err(kfd_device,
                "device %x:%x NOT added due to errors\n",
@@ -881,7 +881,7 @@ void kgd2kfd_device_exit(struct kfd_dev *kfd)
                kfd_doorbell_fini(kfd);
                ida_destroy(&kfd->doorbell_ida);
                kfd_gtt_sa_fini(kfd);
-               amdgpu_amdkfd_free_gtt_mem(kfd->adev, kfd->gtt_mem);
+               amdgpu_amdkfd_free_gtt_mem(kfd->adev, &kfd->gtt_mem);
        }
 
        kfree(kfd);

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
index c08b6ee252898d96981c16a8d739e7779778c802..dbef9eac2694f971ac6e7e99f6078f7efa5a686b 100644 (file)
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -2633,7 +2633,7 @@ static void deallocate_hiq_sdma_mqd(struct kfd_node *dev,
 {
        WARN(!mqd, "No hiq sdma mqd trunk to free");
 
-       amdgpu_amdkfd_free_gtt_mem(dev->adev, mqd->gtt_mem);
+       amdgpu_amdkfd_free_gtt_mem(dev->adev, &mqd->gtt_mem);
 }
 
 void device_queue_manager_uninit(struct device_queue_manager *dqm)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c
index 8746a61a852dc230d3c84a843f96478c4cd7bead..d501fd2222dc39d66679777f49ea68aa8ed536bc 100644 (file)
--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c
@@ -223,7 +223,7 @@ void kfd_free_mqd_cp(struct mqd_manager *mm, void *mqd,
              struct kfd_mem_obj *mqd_mem_obj)
 {
        if (mqd_mem_obj->gtt_mem) {
-               amdgpu_amdkfd_free_gtt_mem(mm->dev->adev, mqd_mem_obj->gtt_mem);
+               amdgpu_amdkfd_free_gtt_mem(mm->dev->adev, &mqd_mem_obj->gtt_mem);
                kfree(mqd_mem_obj);
        } else {
                kfd_gtt_sa_free(mm->dev, mqd_mem_obj);

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
index 451bb058cc62039eaf98c0e90487c0884042dfa4..66150ea8e64d806601fb45bfdcea155ee98eaa08 100644 (file)
--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
@@ -1048,7 +1048,7 @@ static void kfd_process_destroy_pdds(struct kfd_process *p)
 
                if (pdd->dev->kfd->shared_resources.enable_mes)
                        amdgpu_amdkfd_free_gtt_mem(pdd->dev->adev,
-                                                  pdd->proc_ctx_bo);
+                                                  &pdd->proc_ctx_bo);
                /*
                 * before destroying pdd, make sure to report availability
                 * for auto suspend

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
index a5bdc3258ae54ae21a41eedcd4ffb119afd4e78f..c97b4fc44859d94308ce4a707a51e740bfd2f506 100644 (file)
--- a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
@@ -201,9 +201,9 @@ static void pqm_clean_queue_resource(struct process_queue_manager *pqm,
        }
 
        if (dev->kfd->shared_resources.enable_mes) {
-               amdgpu_amdkfd_free_gtt_mem(dev->adev, pqn->q->gang_ctx_bo);
+               amdgpu_amdkfd_free_gtt_mem(dev->adev, &pqn->q->gang_ctx_bo);
                if (pqn->q->wptr_bo)
-                       amdgpu_amdkfd_free_gtt_mem(dev->adev, pqn->q->wptr_bo);
+                       amdgpu_amdkfd_free_gtt_mem(dev->adev, (void **)&pqn->q->wptr_bo);
        }
 }