From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f176.google.com (mail-pg1-f176.google.com [209.85.215.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9E454264A97 for ; Sun, 9 Aug 2026 14:46:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.176 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786286793; cv=none; b=LxpDhqmx+eiTxk/flHyQr6cv5nKOjmcBUIEZlbl3b4qQbUQr4yC0Ei3HQ42ySpr8KlIgt1Zble5qJUbIBfT9Z6m9eP4so0OOW7Ag9wBZyuLHkAKPdHHilA5vZZNZmI4bN00xdPGO2TzdLlRI1qDwGsBmOuJWDJKcgFQBnkKRzIw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786286793; c=relaxed/simple; bh=aDj5aLG7NStNslfYhTIl3YYv6XZgFNUFXK8u7qYzlf0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=p1uq5KKXhLKE2bNSMq45OIkteEkYzDolo4neDP8LtpJztHpWFyPQR9dHkz1uyRShmK1bZdEAHVDWCVBJjv0eQzRqPOtd/980O/MUlATdB7KPPnDcUIudT2sX+BNKsp5OMk0Sa6INxUqOu5CzrzGqc0kp3hTPaS7i7ZncD3DiSjU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Vlu1vdBh; arc=none smtp.client-ip=209.85.215.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Vlu1vdBh" Received: by mail-pg1-f176.google.com with SMTP id 41be03b00d2f7-ca7bea5e5b3so821093a12.1 for ; Sun, 09 Aug 2026 07:46:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786286792; x=1786891592; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=A3BeIAtfJ2/omVu82I5VMk45uIa8CTiHrIT/44X40ds=; b=Vlu1vdBhhJ5wFJxgLhLekISOcT8uuDAJbhlDFgUfFTBizj1mP1zUCnShcSFzbIr0mg TDpeLBMhZM4/G3CVcWW02fMGJW69l8/X8ANyhPlKlbRYt2RuPzBOGDcvDqGdZiOqKJIT StSKrGeMMfkeHA5cpIaLV87/IxrxUWgiKMPDT0VdTrUzMLyRYnr6XbirgK5B2EtBAo4I H4L/gTuMWu8QUQG87f3gWpjiAF0QZip4CHrf1WCPra+gyJW7lK75/ix61Y5escDxdFph 0pm3Z+uLZh1Vu9qvExHYpICwVlEtumuajvLhfQHlLWOuTQEWysKvtybnApjb+Mb3OMrY 6kaQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786286792; x=1786891592; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=A3BeIAtfJ2/omVu82I5VMk45uIa8CTiHrIT/44X40ds=; b=TU6u0Orp26KLl2HB63BL+RZo9RkFCEG4cQIlQa3ae0utUxMERiP/g9tuuGnXlpJeMD 5Uyt4jRBbY/lml65q9qf45FGoMBsIPO9GIGwIrTMIPk9VcDlY7zYVVbLhEcRmsB3+q9o ahi2ZbXW3DeuvzzS4OwNtLtZA9f+2q8YU5DfQyMpHBt2ZvmkBMh1JPL9TuImoo0oL4RN TZlP35wRf33ioGqCkG4fZyIrFUO1E5vkNqI9bTH2kvcMEw33jsJB+rcoOxxYZpc8YfCT gm2UC4zAVLiKKFM1eHBhO6Vt7JkfvgT5lugpbK7jxP9uhLzzB9l7VExY4EdNLZKqAwji mFjg== X-Forwarded-Encrypted: i=1; AHgh+RrX3AfF0bsutwtNj3PuOODEAVU3a6I90v5XKuL13JKJaaDptUnFPOnRTdymgFBIyznZB/wC4ZvMkWy67nM=@vger.kernel.org X-Gm-Message-State: AOJu0Yw0QHkhTXqTYsrront7u9Pt3R+xNs/9rQ3pDubf7lp5Yxx28UAz R96dFC6ZrVQqxEHJQnoL/lWeJKOdb3PpoekHkvxp92eIB+NadDD5yMQbG9Bjhm6o X-Gm-Gg: AR+sD13q1kUkfun+pv8EwyZH7ql/ji8zLKIWI+316aQsu9tWQqtdrH0TSlpdlikD6kE vMwYbPB8RpVQr5A7YK5dqDZqrUcphyYpt9c3QSmDktxcNfLPF7se4T+gRCNoGPB5VKtoanFGkPv +dWht+2lQLMt0UJsIeRMZILTyU6Ap1QbnbGqRHso4J2Ni9VTQ32B4bjmnHuuVHpKYv6glVnqY0U IIw/psRhcQYDGbWHYstk9kNQQh7woTSM4PYK1/OWv97jUUqmF8+EUZ2dI1k36vGHHulzD+ZoZKo U9jmPtE1Sap0bYG/uquluXUiO5eAH7pexD5WgyojmmmaPolQKTS9gL5CTENLUvnOYrQtgCwpgHC LzZLz5QfB+u85tGPOcwOxq8bNs/l41fX6TFepd3SyW26TnFVfLnMD1Jd/egc6fa9uO/mMcwDMyw 21gY1kA9jwpGaM6IZdb1Sv8qmzdgKcGMZO5Biu4xla3MZqLAH9RxpN3x1CXzHPD1lQZ0xVjm92A 2cnns4rHGLRhFV0aqzKjzM= X-Received: by 2002:a05:6a20:914b:b0:3c3:bbe6:95b1 with SMTP id adf61e73a8af0-3cb85eef9d6mr36805745637.24.1786286791895; Sun, 09 Aug 2026 07:46:31 -0700 (PDT) Received: from localhost.localdomain ([103.178.205.91]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-14101b7ad29sm25911224c88.13.2026.08.09.07.46.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Aug 2026 07:46:31 -0700 (PDT) From: Sreeraj S Kurup To: alexander.deucher@amd.com, christian.koenig@amd.com Cc: amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, airlied@gmail.com, simona@ffwll.ch, Sreeraj S Kurup Subject: [PATCH v5 1/4] drm/amdgpu/aca: Fix race condition and UAF in error cache logging Date: Sun, 9 Aug 2026 14:44:48 +0000 Message-ID: <20260809144451.35431-2-sreekuttan2156239@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260809144451.35431-1-sreekuttan2156239@gmail.com> References: <20260809144451.35431-1-sreekuttan2156239@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit In aca_error_cache_log_bank_error(), find_bank_error() released aerr->lock prior to returning bank_error. This created a time-of-check to time-of-use (TOCTOU) race window where a concurrent caller of aca_log_aca_error() could acquire aerr->lock and free the bank_error node via aca_bank_error_remove(). When execution returned to aca_error_cache_log_bank_error(), incrementing bank_error->count resulted in a Use-After-Free and potential kernel memory corruption. Additionally, bank_error->count was updated outside mutex lock protection. Fix this by acquiring aerr->lock at the start of aca_error_cache_log_bank_error() and holding it continuously across lookup, creation, and counter updates, while removing redundant internal lock acquisitions in helper functions. Signed-off-by: Sreeraj S Kurup --- drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c index db7858fe0c3d..d0d473082431 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c @@ -237,10 +237,8 @@ static struct aca_bank_error *new_bank_error(struct aca_error *aerr, struct aca_ INIT_LIST_HEAD(&bank_error->node); memcpy(&bank_error->info, info, sizeof(*info)); - mutex_lock(&aerr->lock); list_add_tail(&bank_error->node, &aerr->list); aerr->nr_errors++; - mutex_unlock(&aerr->lock); return bank_error; } @@ -249,22 +247,16 @@ static struct aca_bank_error *find_bank_error(struct aca_error *aerr, struct aca { struct aca_bank_error *bank_error = NULL; struct aca_bank_info *tmp_info; - bool found = false; - mutex_lock(&aerr->lock); list_for_each_entry(bank_error, &aerr->list, node) { tmp_info = &bank_error->info; if (tmp_info->socket_id == info->socket_id && tmp_info->die_id == info->die_id) { - found = true; - goto out_unlock; + return bank_error; } } -out_unlock: - mutex_unlock(&aerr->lock); - - return found ? bank_error : NULL; + return NULL; } static void aca_bank_error_remove(struct aca_error *aerr, struct aca_bank_error *bank_error) @@ -306,11 +298,15 @@ int aca_error_cache_log_bank_error(struct aca_handle *handle, struct aca_bank_in return 0; aerr = &error_cache->errors[type]; + mutex_lock(&aerr->lock); bank_error = get_bank_error(aerr, info); - if (!bank_error) + if (!bank_error) { + mutex_unlock(&aerr->lock); return -ENOMEM; + } bank_error->count += count; + mutex_unlock(&aerr->lock); return 0; } -- 2.54.0