[PATCH] drm/amdgpu: check ras and obj before dereference

[PATCH] drm/amdgpu: check ras and obj before dereference

[Dmitriy Chumachenko]

nbio_v7_9_handle_ras_controller_intr_no_bifring() dereferences ras and obj
without checking either for NULL. Both amdgpu_ras_get_context() and 
amdgpu_ras_find_obj() can return NULL, e.g. during the window between 
adev->nbio.ras being set (early in amdgpu_ras_init(), by design, to 
enable the fatal-error interrupt as soon as possible) and the PCIE_BIF 
ras object actually being created in RAS late_init. Any interrupt in that 
window crashes in hard-IRQ context.

This is analogous to commit d190b459b2a4 ("drm/amdgpu: the warning
dereferencing obj for nbio_v7_4"), which fixed the same issue in the
nbio_v7_4 handler.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 7692e1ee2446 ("drm/amdgpu: add RAS fatal error handler for NBIO v7.9")
Signed-off-by: Dmitriy Chumachenko <Dmitry.Chumachenko@cyberprotect.ru>
---
 drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c b/drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c
index 8e401f8b2a05..2b3a1b9f8efc 100644
--- a/drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c
+++ b/drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c
@@ -518,7 +518,7 @@ static void nbio_v7_9_handle_ras_controller_intr_no_bifring(struct amdgpu_device
 						RAS_CNTLR_INTERRUPT_CLEAR, 1);
 		WREG32_SOC15(NBIO, 0, regBIF_BX0_BIF_DOORBELL_INT_CNTL, bif_doorbell_intr_cntl);
 
-		if (!ras->disable_ras_err_cnt_harvest) {
+		if (ras && !ras->disable_ras_err_cnt_harvest && obj) {
 			/*
 			 * clear error status after ras_controller_intr
 			 * according to hw team and count ue number
-- 
2.49.0

Re: [PATCH] drm/amdgpu: check ras and obj before dereference

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] amdgpu_ras_global_ras_isr and amdgpu_ras_reset_gpu dereference ras without checking if it is NULL.
--

commit 968ac5f5bc519258a8c9858799f60257d1c4fa96
Author: Dmitriy Chumachenko <Dmitry.Chumachenko@cyberprotect.ru>

drm/amdgpu: check ras and obj before dereference

This patch adds NULL checks for the ras and obj pointers in
nbio_v7_9_handle_ras_controller_intr_no_bifring() before dereferencing them.
This prevents a hard-IRQ context crash during the initialization window where
the fatal-error interrupt is enabled but the RAS context is not fully created.

> diff --git a/drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c b/drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c
> index bdfd2917e3cab..def02993b7cfd 100644
> --- a/drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c
> +++ b/drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c
> @@ -535,7 +535,7 @@ static void nbio_v7_9_handle_ras_controller_intr_no_bifring(struct amdgpu_device
>  						RAS_CNTLR_INTERRUPT_CLEAR, 1);
>  		WREG32_SOC15(NBIO, 0, regBIF_BX0_BIF_DOORBELL_INT_CNTL, bif_doorbell_intr_cntl);
>  
> -		if (!ras->disable_ras_err_cnt_harvest) {
> +		if (ras && !ras->disable_ras_err_cnt_harvest && obj) {

[Severity: High]
This isn't a bug introduced by this patch, but while this change fixes the NULL
pointer dereference here, it looks like there are similar vulnerabilities in
other interrupt handlers during this same initialization window.

If the ATHUB interrupt fires when the RAS context is unavailable, its handler
delegates to amdgpu_ras_global_ras_isr(), which fetches the RAS context via
amdgpu_ras_get_context() but unconditionally dereferences it:

drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c:amdgpu_ras_global_ras_isr() {
    ...
    ras->gpu_reset_flags |= AMDGPU_RAS_GPU_RESET_MODE1_RESET;
    ...
}

It then calls amdgpu_ras_reset_gpu(), which also uses the ras pointer without
a NULL check:

drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c:amdgpu_ras_reset_gpu() {
    ...
    if (atomic_cmpxchg(&ras->in_recovery, 0, 1) == 0) {
    ...
}

Both direct dereferences will cause a hard-IRQ context kernel panic if ras is
NULL. Should these paths also include a check for the RAS context?

>  			/*
>  			 * clear error status after ras_controller_intr
>  			 * according to hw team and count ue number

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260914143303.90614-1-Dmitry.Chumachenko@cyberprotect.ru?part=1

RE: [PATCH] drm/amdgpu: check ras and obj before dereference

[Zhou1, Tao]

AMD General

Reviewed-by: Tao Zhou <tao.zhou1@amd.com>

> -----Original Message-----
> From: Dmitriy Chumachenko <Dmitry.Chumachenko@cyberprotect.ru>
> Sent: Monday, September 14, 2026 10:33 PM
> To: Deucher, Alexander <Alexander.Deucher@amd.com>
> Cc: Koenig, Christian <Christian.Koenig@amd.com>; David Airlie <airlied@linux.ie>;
> Daniel Vetter <daniel@ffwll.ch>; Zhang, Hawking <Hawking.Zhang@amd.com>;
> Zhou1, Tao <Tao.Zhou1@amd.com>; amd-gfx@lists.freedesktop.org; dri-
> devel@lists.freedesktop.org; linux-kernel@vger.kernel.org; lvc-
> project@linuxtesting.org; Dmitriy Chumachenko
> <Dmitry.Chumachenko@cyberprotect.ru>
> Subject: [PATCH] drm/amdgpu: check ras and obj before dereference
>
> [Some people who received this message don't often get email from
> dmitry.chumachenko@cyberprotect.ru. Learn why this is important at
> https://aka.ms/LearnAboutSenderIdentification ]
>
> nbio_v7_9_handle_ras_controller_intr_no_bifring() dereferences ras and obj without
> checking either for NULL. Both amdgpu_ras_get_context() and
> amdgpu_ras_find_obj() can return NULL, e.g. during the window between
> adev->nbio.ras being set (early in amdgpu_ras_init(), by design, to
> enable the fatal-error interrupt as soon as possible) and the PCIE_BIF ras object
> actually being created in RAS late_init. Any interrupt in that window crashes in hard-
> IRQ context.
>
> This is analogous to commit d190b459b2a4 ("drm/amdgpu: the warning
> dereferencing obj for nbio_v7_4"), which fixed the same issue in the
> nbio_v7_4 handler.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Fixes: 7692e1ee2446 ("drm/amdgpu: add RAS fatal error handler for NBIO v7.9")
> Signed-off-by: Dmitriy Chumachenko <Dmitry.Chumachenko@cyberprotect.ru>
> ---
>  drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c
> b/drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c
> index 8e401f8b2a05..2b3a1b9f8efc 100644
> --- a/drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c
> +++ b/drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c
> @@ -518,7 +518,7 @@ static void
> nbio_v7_9_handle_ras_controller_intr_no_bifring(struct amdgpu_device
>                                                 RAS_CNTLR_INTERRUPT_CLEAR, 1);
>                 WREG32_SOC15(NBIO, 0, regBIF_BX0_BIF_DOORBELL_INT_CNTL,
> bif_doorbell_intr_cntl);
>
> -               if (!ras->disable_ras_err_cnt_harvest) {
> +               if (ras && !ras->disable_ras_err_cnt_harvest && obj) {
>                         /*
>                          * clear error status after ras_controller_intr
>                          * according to hw team and count ue number
> --
> 2.49.0

Re: [PATCH] drm/amdgpu: check ras and obj before dereference

[Alex Deucher]

Applied.  Thanks!

Alex

On Mon, Sep 14, 2026 at 11:15 PM Zhou1, Tao <Tao.Zhou1@amd.com> wrote:
>
> AMD General
>
> Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
>
> > -----Original Message-----
> > From: Dmitriy Chumachenko <Dmitry.Chumachenko@cyberprotect.ru>
> > Sent: Monday, September 14, 2026 10:33 PM
> > To: Deucher, Alexander <Alexander.Deucher@amd.com>
> > Cc: Koenig, Christian <Christian.Koenig@amd.com>; David Airlie <airlied@linux.ie>;
> > Daniel Vetter <daniel@ffwll.ch>; Zhang, Hawking <Hawking.Zhang@amd.com>;
> > Zhou1, Tao <Tao.Zhou1@amd.com>; amd-gfx@lists.freedesktop.org; dri-
> > devel@lists.freedesktop.org; linux-kernel@vger.kernel.org; lvc-
> > project@linuxtesting.org; Dmitriy Chumachenko
> > <Dmitry.Chumachenko@cyberprotect.ru>
> > Subject: [PATCH] drm/amdgpu: check ras and obj before dereference
> >
> > [Some people who received this message don't often get email from
> > dmitry.chumachenko@cyberprotect.ru. Learn why this is important at
> > https://aka.ms/LearnAboutSenderIdentification ]
> >
> > nbio_v7_9_handle_ras_controller_intr_no_bifring() dereferences ras and obj without
> > checking either for NULL. Both amdgpu_ras_get_context() and
> > amdgpu_ras_find_obj() can return NULL, e.g. during the window between
> > adev->nbio.ras being set (early in amdgpu_ras_init(), by design, to
> > enable the fatal-error interrupt as soon as possible) and the PCIE_BIF ras object
> > actually being created in RAS late_init. Any interrupt in that window crashes in hard-
> > IRQ context.
> >
> > This is analogous to commit d190b459b2a4 ("drm/amdgpu: the warning
> > dereferencing obj for nbio_v7_4"), which fixed the same issue in the
> > nbio_v7_4 handler.
> >
> > Found by Linux Verification Center (linuxtesting.org) with SVACE.
> >
> > Fixes: 7692e1ee2446 ("drm/amdgpu: add RAS fatal error handler for NBIO v7.9")
> > Signed-off-by: Dmitriy Chumachenko <Dmitry.Chumachenko@cyberprotect.ru>
> > ---
> >  drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c
> > b/drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c
> > index 8e401f8b2a05..2b3a1b9f8efc 100644
> > --- a/drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c
> > +++ b/drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c
> > @@ -518,7 +518,7 @@ static void
> > nbio_v7_9_handle_ras_controller_intr_no_bifring(struct amdgpu_device
> >                                                 RAS_CNTLR_INTERRUPT_CLEAR, 1);
> >                 WREG32_SOC15(NBIO, 0, regBIF_BX0_BIF_DOORBELL_INT_CNTL,
> > bif_doorbell_intr_cntl);
> >
> > -               if (!ras->disable_ras_err_cnt_harvest) {
> > +               if (ras && !ras->disable_ras_err_cnt_harvest && obj) {
> >                         /*
> >                          * clear error status after ras_controller_intr
> >                          * according to hw team and count ue number
> > --
> > 2.49.0
>