[PATCH] drm/amdgpu: fix NULL RAS context dereference in UMC page retirement

[PATCH] drm/amdgpu: fix NULL RAS context dereference in UMC page retirement

[Haotian Zhang]

amdgpu_umc_handle_bad_pages() and amdgpu_umc_do_page_retirement() take the
RAS context from amdgpu_ras_get_context() and dereference it without
checking for NULL.  That context is NULL whenever RAS is disabled: during
amdgpu_ras_init() the release_con path calls amdgpu_ras_set_context(adev,
NULL) and frees it when !adev->ras_enabled on non-VEGA20 hardware.  The
GFX11 KFD poison consumption interrupt (kfd_int_process_v11.c) is not
gated on RAS and reaches amdgpu_umc_pasid_poison_handler() ->
amdgpu_umc_do_page_retirement() -> amdgpu_umc_handle_bad_pages(), which
then crashes on mutex_lock(&con->page_retirement_lock) and
con->eeprom_control.

Return early from amdgpu_umc_handle_bad_pages() and
amdgpu_umc_do_page_retirement() when the RAS context is NULL.

Fixes: 513befa63446 ("drm/amdgpu: message smu to update hbm bad page number")
Assisted-by: DeepSeek-V4.1-Flash
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c
index 71d34fd09385..832e9f64421d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c
@@ -101,6 +101,10 @@ void amdgpu_umc_handle_bad_pages(struct amdgpu_device *adev,
 	int ret = 0;
 	unsigned long err_count;
 
+	/* RAS is disabled, nothing to retire. */
+	if (!con)
+		return;
+
 	amdgpu_ras_get_error_query_mode(adev, &error_query_mode);
 
 	err_data->err_addr =
@@ -216,6 +220,9 @@ static int amdgpu_umc_do_page_retirement(struct amdgpu_device *adev,
 	kgd2kfd_set_sram_ecc_flag(adev->kfd.dev);
 	amdgpu_umc_handle_bad_pages(adev, ras_error_status);
 
+	if (!con)
+		return AMDGPU_RAS_SUCCESS;
+
 	if ((err_data->ue_count || err_data->de_count) &&
 	    (reset || amdgpu_ras_is_rma(adev))) {
 		con->gpu_reset_flags |= reset;
-- 
2.25.1

Re: [PATCH] drm/amdgpu: fix NULL RAS context dereference in UMC page retirement

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] amdgpu: KFD queue permanently hung when RAS is disabled due to bypassed GPU reset
--

commit 8cb95b8549bf147ff94f08bcdd4e5a3aaa6812ae
Author: Haotian Zhang <vulab@iscas.ac.cn>

drm/amdgpu: fix NULL RAS context dereference in UMC page retirement

amdgpu_umc_handle_bad_pages() and amdgpu_umc_do_page_retirement() take the
RAS context from amdgpu_ras_get_context() and dereference it without
checking for NULL.  That context is NULL whenever RAS is disabled.

> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c
> index 34702e5cb1b6c..283180e3f2db2 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c
[ ... ]
> @@ -217,6 +221,9 @@ static int amdgpu_umc_do_page_retirement(struct amdgpu_device *adev,
>  	kgd2kfd_set_sram_ecc_flag(adev->kfd.dev);
>  	amdgpu_umc_handle_bad_pages(adev, ras_error_status);
>  
> +	if (!con)
> +		return AMDGPU_RAS_SUCCESS;
> +

[Severity: High]
Does this early return ignore the reset parameter requested by the caller?

When KFD encounters a poison consumption error and requests a fallback GPU
reset by passing a non-zero reset flag, returning AMDGPU_RAS_SUCCESS here
without handling the reset leaves the KFD queue permanently hung.

This leaves the hardware in an unrecoverable state until the next system
reboot.

Should this trigger a generic GPU reset via amdgpu_device_gpu_recover()
when the context is NULL?

Also, is there a similar regression in amdgpu_umc_pasid_poison_handler()?

	if (adev->gmc.xgmi.connected_to_cpu ||
		adev->gmc.is_app_apu) {
		if (reset) {
			/* MCA poison handler is only responsible for GPU reset,
			 * let MCA notifier do page retirement.
			 */
			kgd2kfd_set_sram_ecc_flag(adev->kfd.dev);
			amdgpu_ras_reset_gpu(adev);
		}
		return ret;
	}

If reset is requested and xgmi.connected_to_cpu is true, this unconditionally
calls amdgpu_ras_reset_gpu().

Can this still trigger a NULL pointer dereference inside amdgpu_ras_reset_gpu()
when RAS is disabled?

>  	if ((err_data->ue_count || err_data->de_count) &&
>  	    (reset || amdgpu_ras_is_rma(adev))) {
>  		con->gpu_reset_flags |= reset;
>  		amdgpu_ras_reset_gpu(adev);
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261008161144.2671028-1-vulab@iscas.ac.cn?part=1