From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f180.google.com (mail-pl1-f180.google.com [209.85.214.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A3E67313E38 for ; Sun, 9 Aug 2026 05:13:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.180 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786252389; cv=none; b=kZscu/NatZBLfS7u1TPl2qkGCMIEotK++23WeVhdRh77xTVDJr5mzdtvUjgr2fuJ932PmMtJxkJJF4VJDIwoze/Cg+OuNwdlF6UqcGmamkxtI+jR5XoqKXEBcT6mz7lD6TWvxhBWCXuvPfxqNmUtGSDCOM5jPRJqymx+fuewvbg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786252389; c=relaxed/simple; bh=aDj5aLG7NStNslfYhTIl3YYv6XZgFNUFXK8u7qYzlf0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=t2pWntEg+jRkazSnbEIzsT5ax3hiLrOsz41q2uXh6VWRx4H0TZ+mOPLC2AtDEhiYRjlyH9tyMzaPN7AnyyM4ylzE01VUk+Nocn7xp9+Z11w91w5RXmeffUH6uB78uzGioNwGlNlr7akwsI5cVvJ5TzfuaZV9BbDoVZifplghUzU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Wy07lA7Z; arc=none smtp.client-ip=209.85.214.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Wy07lA7Z" Received: by mail-pl1-f180.google.com with SMTP id d9443c01a7336-2cee9b74ee1so6906665ad.3 for ; Sat, 08 Aug 2026 22:13:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786252388; x=1786857188; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=A3BeIAtfJ2/omVu82I5VMk45uIa8CTiHrIT/44X40ds=; b=Wy07lA7Z6SdoTXQHoRxg3TsA0mvR1G1JD/6HOD0mNNmX3wqpqNbepSmltG5Rwz50UW x2U728Ci2IWafVVr4FlgpliMSRZezoXn9oov7rIWjH/qeU8DIh+wvY28pz9HGshngzbj 1Hvo0U5Sv+qdnJQ7GCZgY1fAIAHxGcesuy6Ebg8R5IE/37YxIz9h+VSz32nsxb8Vm+4P Eeef+XddLV05mrIjnnvpAu7iK4R7x1CGhHgxyzHjv0rYql05aIv+jf+x/zbnfCp4Jvp7 zMhuUfg5v9uQxymfvhMGYhmGK3Gte1Ku6UgCU3UCuHSmJ4eUdYImv4uQ0ySXZzoU+x00 A2Wg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786252388; x=1786857188; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=A3BeIAtfJ2/omVu82I5VMk45uIa8CTiHrIT/44X40ds=; b=U1yzhN1GlTm/vxD1OpZI2b7A0YbPRPhz9hZqI7QXUd4cC84Vk2XLKEa9NEoEZqt6zC YIcSRYsTx4Fi3Xu30QMzLkiLqeQU3oE4tXZFC0TIFMiJ2pGuDON+lLINebZdM2iEdUBR vYAIBbgyGeLgHiBg13ljDak2tyAXI6VX1VZ5fiupgt7t7obh3+pYh2yHD5ekDtMGU8BW ULadanUbhQhemQCiGNdm79Al/jmOVQvNbwKsp5vcZeTNc1dLEKnGU/zm7tY1s9FsEDgd cFabueMe9CABCNYdnKmSMHg2dmC4+FEKqRlCBFm8fhOWaFh3Lkek6wpChiUoESaqyzN6 zkww== X-Forwarded-Encrypted: i=1; AHgh+RpoRmZs0gby+/Ow7eA1DhgTEEnrpaLZ/ZG9E34MSPZVjdQptagLNRLTXQDwIjG7hM7BLrjt1Wir32LpxD8=@vger.kernel.org X-Gm-Message-State: AOJu0YzYMJcjWBkvRjA6X/ax8SgVUKSTpoggBvtwtYR90dL8bT19q+LR b1CWA+LtvxRv2slnveonx5ErpOP5saayFU1JhjImeZlYdjNe48pHBFvu X-Gm-Gg: AR+sD10DlHh/0XRDDo4LbPqPnOaoa0SHjqZEICEcSqILaKgbgmDogxHsLBnaIz+rpla CnZnt477TzLGUJf3tFrwy3KJndsh/CYwhUFH95EGOhveVkLlPW/aHpDuqHgc2mgbWCp82rHN1/C iy/uTuWKTjbYRENawo4khqkp2rNrLn8HsaAmztXxDKn5r4ad4syVumsrFaGlpR1FeQ0m6nSrLDP uPupDi/x0POA3LLFHyLGiaipExEuyavvjedQMGnjsmUIaF3Sdg1xhewDhApZ9KITY8G2s5+iZMd eR5+H//pJGdf7H9w7cU31tbo4eVe9dQ5B0RpBJMkv1+mVNnn0vkG/Nz9podN60kHnf3rSAh5Yy4 IFVEKNX9UUuYkvSv7fr1pq6PMGVoj/EQ2EuLwK4tTVc+j7nC2M30SDx2evhyWYa5tYKeOWSSgbY usCC7I+6A3qleR5lrLyYCv2CaYTs+zlix/+7rE+4rVOcHbkH8MsKL0QYaWtmFql3tNH0r0+C4Wc lSaZS/ZG/xx X-Received: by 2002:a05:6a21:a38d:b0:3bf:6fb1:ce0d with SMTP id adf61e73a8af0-3cb85ea3663mr41867421637.21.1786252387800; Sat, 08 Aug 2026 22:13:07 -0700 (PDT) Received: from localhost.localdomain ([103.178.204.108]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-315be8a7395sm27095702eec.9.2026.08.08.22.13.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 08 Aug 2026 22:13:07 -0700 (PDT) From: Sreeraj S Kurup To: alexander.deucher@amd.com, christian.koenig@amd.com Cc: amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, airlied@gmail.com, simona@ffwll.ch, Sreeraj S Kurup Subject: [PATCH v3 1/6] drm/amdgpu/aca: Fix race condition and UAF in error cache logging Date: Sun, 9 Aug 2026 05:11:55 +0000 Message-ID: <20260809051200.3276-2-sreekuttan2156239@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260809051200.3276-1-sreekuttan2156239@gmail.com> References: <20260809051200.3276-1-sreekuttan2156239@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit In aca_error_cache_log_bank_error(), find_bank_error() released aerr->lock prior to returning bank_error. This created a time-of-check to time-of-use (TOCTOU) race window where a concurrent caller of aca_log_aca_error() could acquire aerr->lock and free the bank_error node via aca_bank_error_remove(). When execution returned to aca_error_cache_log_bank_error(), incrementing bank_error->count resulted in a Use-After-Free and potential kernel memory corruption. Additionally, bank_error->count was updated outside mutex lock protection. Fix this by acquiring aerr->lock at the start of aca_error_cache_log_bank_error() and holding it continuously across lookup, creation, and counter updates, while removing redundant internal lock acquisitions in helper functions. Signed-off-by: Sreeraj S Kurup --- drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c index db7858fe0c3d..d0d473082431 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c @@ -237,10 +237,8 @@ static struct aca_bank_error *new_bank_error(struct aca_error *aerr, struct aca_ INIT_LIST_HEAD(&bank_error->node); memcpy(&bank_error->info, info, sizeof(*info)); - mutex_lock(&aerr->lock); list_add_tail(&bank_error->node, &aerr->list); aerr->nr_errors++; - mutex_unlock(&aerr->lock); return bank_error; } @@ -249,22 +247,16 @@ static struct aca_bank_error *find_bank_error(struct aca_error *aerr, struct aca { struct aca_bank_error *bank_error = NULL; struct aca_bank_info *tmp_info; - bool found = false; - mutex_lock(&aerr->lock); list_for_each_entry(bank_error, &aerr->list, node) { tmp_info = &bank_error->info; if (tmp_info->socket_id == info->socket_id && tmp_info->die_id == info->die_id) { - found = true; - goto out_unlock; + return bank_error; } } -out_unlock: - mutex_unlock(&aerr->lock); - - return found ? bank_error : NULL; + return NULL; } static void aca_bank_error_remove(struct aca_error *aerr, struct aca_bank_error *bank_error) @@ -306,11 +298,15 @@ int aca_error_cache_log_bank_error(struct aca_handle *handle, struct aca_bank_in return 0; aerr = &error_cache->errors[type]; + mutex_lock(&aerr->lock); bank_error = get_bank_error(aerr, info); - if (!bank_error) + if (!bank_error) { + mutex_unlock(&aerr->lock); return -ENOMEM; + } bank_error->count += count; + mutex_unlock(&aerr->lock); return 0; } -- 2.54.0