[PATCH] drm/amdgpu: Fix double free of dmabuf

[PATCH] drm/amdgpu: Fix double free of dmabuf

[xinhui pan]

amdgpu_amdkfd_gpuvm_free_memory_of_gpu drop dmabuf reference increased in
amdgpu_gem_prime_export.
amdgpu_bo_destroy drop dmabuf reference increased in
amdgpu_gem_prime_import.

So remove this extra dma_buf_put to avoid double free.

Signed-off-by: xinhui pan <xinhui.pan@amd.com>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
index 6c6d5d994b5d..0f68d28e002e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
@@ -665,12 +665,6 @@ kfd_mem_attach_dmabuf(struct amdgpu_device *adev, struct kgd_mem *mem,
 	if (IS_ERR(gobj))
 		return PTR_ERR(gobj);
 
-	/* Import takes an extra reference on the dmabuf. Drop it now to
-	 * avoid leaking it. We only need the one reference in
-	 * kgd_mem->dmabuf.
-	 */
-	dma_buf_put(mem->dmabuf);
-
 	*bo = gem_to_amdgpu_bo(gobj);
 	(*bo)->flags |= AMDGPU_GEM_CREATE_PREEMPTIBLE;
 	(*bo)->parent = amdgpu_bo_ref(mem->bo);
-- 
2.25.1

Re: [PATCH] drm/amdgpu: Fix double free of dmabuf

[Christian König]

Am 19.11.21 um 11:17 schrieb xinhui pan:
> amdgpu_amdkfd_gpuvm_free_memory_of_gpu drop dmabuf reference increased in
> amdgpu_gem_prime_export.
> amdgpu_bo_destroy drop dmabuf reference increased in
> amdgpu_gem_prime_import.
>
> So remove this extra dma_buf_put to avoid double free.
>
> Signed-off-by: xinhui pan <xinhui.pan@amd.com>

Yeah, Felix pinged me as well that the DMA-buf import code looks odd and 
he is dropping the extra reference which didn't made much sense to me.

Acked-by: Christian König <christian.koenig@amd.com> for this patch for 
now, but I'm going to take another look at this when I have time.

Regards,
Christian.

> ---
>   drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 6 ------
>   1 file changed, 6 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
> index 6c6d5d994b5d..0f68d28e002e 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
> @@ -665,12 +665,6 @@ kfd_mem_attach_dmabuf(struct amdgpu_device *adev, struct kgd_mem *mem,
>   	if (IS_ERR(gobj))
>   		return PTR_ERR(gobj);
>   
> -	/* Import takes an extra reference on the dmabuf. Drop it now to
> -	 * avoid leaking it. We only need the one reference in
> -	 * kgd_mem->dmabuf.
> -	 */
> -	dma_buf_put(mem->dmabuf);
> -
>   	*bo = gem_to_amdgpu_bo(gobj);
>   	(*bo)->flags |= AMDGPU_GEM_CREATE_PREEMPTIBLE;
>   	(*bo)->parent = amdgpu_bo_ref(mem->bo);

Re: [PATCH] drm/amdgpu: Fix double free of dmabuf

[Felix Kuehling]

I'm pretty sure I needed this dma_buf_put to avoid a memory leak. I will
double check later today.

Regards,
  Felix


Am 2021-11-19 um 5:52 a.m. schrieb Christian König:
> Am 19.11.21 um 11:17 schrieb xinhui pan:
>> amdgpu_amdkfd_gpuvm_free_memory_of_gpu drop dmabuf reference
>> increased in
>> amdgpu_gem_prime_export.
>> amdgpu_bo_destroy drop dmabuf reference increased in
>> amdgpu_gem_prime_import.
>>
>> So remove this extra dma_buf_put to avoid double free.
>>
>> Signed-off-by: xinhui pan <xinhui.pan@amd.com>
>
> Yeah, Felix pinged me as well that the DMA-buf import code looks odd
> and he is dropping the extra reference which didn't made much sense to
> me.
>
> Acked-by: Christian König <christian.koenig@amd.com> for this patch
> for now, but I'm going to take another look at this when I have time.
>
> Regards,
> Christian.
>
>> ---
>>   drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 6 ------
>>   1 file changed, 6 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
>> b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
>> index 6c6d5d994b5d..0f68d28e002e 100644
>> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
>> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
>> @@ -665,12 +665,6 @@ kfd_mem_attach_dmabuf(struct amdgpu_device
>> *adev, struct kgd_mem *mem,
>>       if (IS_ERR(gobj))
>>           return PTR_ERR(gobj);
>>   -    /* Import takes an extra reference on the dmabuf. Drop it now to
>> -     * avoid leaking it. We only need the one reference in
>> -     * kgd_mem->dmabuf.
>> -     */
>> -    dma_buf_put(mem->dmabuf);
>> -
>>       *bo = gem_to_amdgpu_bo(gobj);
>>       (*bo)->flags |= AMDGPU_GEM_CREATE_PREEMPTIBLE;
>>       (*bo)->parent = amdgpu_bo_ref(mem->bo);
>

Re: [PATCH] drm/amdgpu: Fix double free of dmabuf

[Felix Kuehling]

On 2021-11-19 5:17 a.m., xinhui pan wrote:
> amdgpu_amdkfd_gpuvm_free_memory_of_gpu drop dmabuf reference increased in
> amdgpu_gem_prime_export.
> amdgpu_bo_destroy drop dmabuf reference increased in
> amdgpu_gem_prime_import.

OK. This was not obvious at all. The get_dma_buf in 
amdgpu_gem_prime_import could use a comment that it's balanced by the 
dma_buf_put in drm_prime_gem_destroy, which gets called from 
amdgpu_bo_destroy for any bo that has a bo->tbo.base.import_attach.

I confirmed the bug and tested the fix by running the following test on 
a 2-GPU system

     HSA_USERPTR_FOR_PAGED_MEM=0 run_kfdtest.sh 
--gtest_filter=KFDMemoryTest.MMBench


>
> So remove this extra dma_buf_put to avoid double free.
>
> Signed-off-by: xinhui pan <xinhui.pan@amd.com>

Tested-by: Felix Kuehling <Felix.Kuehling@amd.com>
Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>


> ---
>   drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 6 ------
>   1 file changed, 6 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
> index 6c6d5d994b5d..0f68d28e002e 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
> @@ -665,12 +665,6 @@ kfd_mem_attach_dmabuf(struct amdgpu_device *adev, struct kgd_mem *mem,
>   	if (IS_ERR(gobj))
>   		return PTR_ERR(gobj);
>   
> -	/* Import takes an extra reference on the dmabuf. Drop it now to
> -	 * avoid leaking it. We only need the one reference in
> -	 * kgd_mem->dmabuf.
> -	 */
> -	dma_buf_put(mem->dmabuf);
> -
>   	*bo = gem_to_amdgpu_bo(gobj);
>   	(*bo)->flags |= AMDGPU_GEM_CREATE_PREEMPTIBLE;
>   	(*bo)->parent = amdgpu_bo_ref(mem->bo);