Re: [PATCH v1 2/3] drm/amdgpu: skip amdgpu_gart_unbind if the device is wedged

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] Skipping `amdgpu_gart_unbind` when the device is wedged leaves GART PTEs pointing to freed system memory, enabling runaway DMA corruption.
--

--- Patch [2]: [PATCH v1 2/3] drm/amdgpu: skip amdgpu_gart_unbind if the device is wedged ---
commit 6802482fc9c63b1193bceee62eda365971bd0506
Author: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com>

drm/amdgpu: skip amdgpu_gart_unbind if the device is wedged

This commit modifies amdgpu_gart_unbind() to return early if the device is
wedged. This avoids unbinding GART pages during a wedged state.

> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
> index c4c21dbbbdbf8..09ddfccb81743 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
> @@ -315,7 +315,7 @@ void amdgpu_gart_unbind(struct amdgpu_device *adev, uint64_t offset,
>  	uint64_t flags = 0;
>  	int idx;
>  
> -	if (!adev->gart.ptr)
> +	if (!adev->gart.ptr || amdgpu_device_is_wedged(adev))
>  		return;

[Severity: Critical]
Does skipping this unbind leave GART PTEs pointing to freed system memory in
amdgpu_gart_unbind()?

When the GPU is wedged, the driver explicitly skips resetting the GPU but
signals all pending fences to unblock the system. TTM responds to these
signaled fences by freeing the backing memory of the completed or killed
jobs, returning the physical pages to the OS.

Because this new code returns early, it skips updating the GART PTEs to the
safe dummy_page_addr. If a userspace application hangs the GPU (e.g. an
infinite loop with memory writes), the application exits, and its memory is
reallocated to other processes or the kernel.

Could the hung GPU, which is deliberately left powered on and electrically
active by the wedge state, continue performing DMA writes through the stale
GART PTEs? This appears it would corrupt the newly allocated system memory,
causing silent corruption on systems where the IOMMU is disabled or running
in passthrough mode.

>  
>  	if (!drm_dev_enter(adev_to_drm(adev), &idx))
>  		return;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260810165322.24682-1-pierre-eric.pelloux-prayer@amd.com?part=2