Re: [PATCH V2] drm/amdgpu: fix a job->pasid access race in gpu recovery

["Christian König" <christian.koenig@amd.com>]

On 12/10/25 21:23, Alex Deucher wrote:
> Avoid a possible UAF in GPU recovery due to a race between
> the sched timeout callback and the tdr work queue.
> 
> The gpu recovery function calls drm_sched_stop() and
> later drm_sched_start().  drm_sched_start() restarts
> the tdr queue which will eventually free the job.  If
> the tdr queue frees the job before time out callback
> completes, the job will be freed and we'll get a UAF
> when accessing the pasid.  Cache it early to avoid the
> UAF.
> 
> Fixes: a72002cb181f ("drm/amdgpu: Make use of drm_wedge_task_info")

Philip and I briefly remember that there was also a bug report about it a while ago.

But I can't find the link of hand, if anybody can find please speak up.

> Cc: SRINIVASAN.SHANMUGAM@amd.com
> Cc: vitaly.prosyak@amd.com
> Cc: christian.koenig@amd.com
> Suggested-by: Matthew Brost <matthew.brost@intel.com>
> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

Reviewed-by: Christian König <christian.koenig@amd.com>

> ---
> 
> v2: Check the pasid rather than job (Lijo)
>     Add fixes tag (Christian)
> 
>  drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
> index 8a851d7548c00..c6b1dd95c401d 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
> @@ -6634,6 +6634,8 @@ int amdgpu_device_gpu_recover(struct amdgpu_device *adev,
>  	struct amdgpu_hive_info *hive = NULL;
>  	int r = 0;
>  	bool need_emergency_restart = false;
> +	/* save the pasid here as the job may be freed before the end of the reset */
> +	int pasid = job ? job->pasid : -EINVAL;
>  
>  	/*
>  	 * If it reaches here because of hang/timeout and a RAS error is
> @@ -6734,8 +6736,12 @@ int amdgpu_device_gpu_recover(struct amdgpu_device *adev,
>  	if (!r) {
>  		struct amdgpu_task_info *ti = NULL;
>  
> -		if (job)
> -			ti = amdgpu_vm_get_task_info_pasid(adev, job->pasid);
> +		/*
> +		 * The job may already be freed at this point via the sched tdr workqueue so
> +		 * use the cached pasid.
> +		 */
> +		if (pasid >= 0)
> +			ti = amdgpu_vm_get_task_info_pasid(adev, pasid);
>  
>  		drm_dev_wedged_event(adev_to_drm(adev), DRM_WEDGE_RECOVERY_NONE,
>  				     ti ? &ti->task : NULL);