[PATCH] drm/amdkfd: Fix a race condition of vram buffer unref in svm code

[PATCH] drm/amdkfd: Fix a race condition of vram buffer unref in svm code

[Xiaogang.Chen]

From: Xiaogang Chen <xiaogang.chen@amd.com>

prange->svm_bo unref can happen in both mmu callback and a callback after
migrate to system ram. Both are async call in different tasks. Sync svm_bo
unref operation to avoid random "use-after-free".

Signed-off-by: Xiaogang.Chen <Xiaogang.Chen@amd.com>
---
 drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
index 70aa882636ab..8e246e848018 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
@@ -637,6 +637,15 @@ void svm_range_vram_node_free(struct svm_range *prange)
 {
 	svm_range_bo_unref(prange->svm_bo);
 	prange->ttm_res = NULL;
+	/* serialize prange->svm_bo unref */
+	mutex_lock(&prange->lock);
+	/* prange->svm_bo has not been unref */
+	if (prange->ttm_res) {
+		prange->ttm_res = NULL;
+		mutex_unlock(&prange->lock);
+		svm_range_bo_unref(prange->svm_bo);
+	} else
+		mutex_unlock(&prange->lock);
 }
 
 struct kfd_node *
-- 
2.25.1

RE: [PATCH] drm/amdkfd: Fix a race condition of vram buffer unref in svm code

[Zhang, Jesse(Jie)]

[AMD Official Use Only - General]

Reviewed-by: Jesse Zhang <Jesse.Zhang@amd.com>
-----Original Message-----
From: Xiaogang.Chen <xiaogang.chen@amd.com>
Sent: Wednesday, September 27, 2023 11:00 AM
To: amd-gfx@lists.freedesktop.org
Cc: Yang, Philip <Philip.Yang@amd.com>; Kuehling, Felix <Felix.Kuehling@amd.com>; Zhang, Jesse(Jie) <Jesse.Zhang@amd.com>; Sierra Guiza, Alejandro (Alex) <Alex.Sierra@amd.com>; Chen, Xiaogang <Xiaogang.Chen@amd.com>; Chen, Xiaogang <Xiaogang.Chen@amd.com>
Subject: [PATCH] drm/amdkfd: Fix a race condition of vram buffer unref in svm code

From: Xiaogang Chen <xiaogang.chen@amd.com>

prange->svm_bo unref can happen in both mmu callback and a callback
prange->after
migrate to system ram. Both are async call in different tasks. Sync svm_bo unref operation to avoid random "use-after-free".

Signed-off-by: Xiaogang.Chen <Xiaogang.Chen@amd.com>
---
 drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
index 70aa882636ab..8e246e848018 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
@@ -637,6 +637,15 @@ void svm_range_vram_node_free(struct svm_range *prange)  {
        svm_range_bo_unref(prange->svm_bo);
        prange->ttm_res = NULL;
+       /* serialize prange->svm_bo unref */
+       mutex_lock(&prange->lock);
+       /* prange->svm_bo has not been unref */
+       if (prange->ttm_res) {
+               prange->ttm_res = NULL;
+               mutex_unlock(&prange->lock);
+               svm_range_bo_unref(prange->svm_bo);
+       } else
+               mutex_unlock(&prange->lock);
 }

 struct kfd_node *
--
2.25.1

Re: [PATCH] drm/amdkfd: Fix a race condition of vram buffer unref in svm code

[Philip Yang]

[-- Attachment #1: Type: text/html, Size: 1929 bytes --]

Re: [PATCH] drm/amdkfd: Fix a race condition of vram buffer unref in svm code

[Eric Huang]

On 2023-09-26 23:00, Xiaogang.Chen wrote:
> From: Xiaogang Chen <xiaogang.chen@amd.com>
>
> prange->svm_bo unref can happen in both mmu callback and a callback after
> migrate to system ram. Both are async call in different tasks. Sync svm_bo
> unref operation to avoid random "use-after-free".
>
> Signed-off-by: Xiaogang.Chen <Xiaogang.Chen@amd.com>
> ---
>   drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 9 +++++++++
>   1 file changed, 9 insertions(+)
>
> diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
> index 70aa882636ab..8e246e848018 100644
> --- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
> +++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
> @@ -637,6 +637,15 @@ void svm_range_vram_node_free(struct svm_range *prange)
>   {
>   	svm_range_bo_unref(prange->svm_bo);
>   	prange->ttm_res = NULL;
Are above two lines not removed?

Regards,
Eric
> +	/* serialize prange->svm_bo unref */
> +	mutex_lock(&prange->lock);
> +	/* prange->svm_bo has not been unref */
> +	if (prange->ttm_res) {
> +		prange->ttm_res = NULL;
> +		mutex_unlock(&prange->lock);
> +		svm_range_bo_unref(prange->svm_bo);
> +	} else
> +		mutex_unlock(&prange->lock);
>   }
>   
>   struct kfd_node *

Re: [PATCH] drm/amdkfd: Fix a race condition of vram buffer unref in svm code

[Chen, Xiaogang]

On 9/27/2023 9:19 AM, Eric Huang wrote:
> Caution: This message originated from an External Source. Use proper 
> caution when opening attachments, clicking links, or responding.
>
>
> On 2023-09-26 23:00, Xiaogang.Chen wrote:
>> From: Xiaogang Chen <xiaogang.chen@amd.com>
>>
>> prange->svm_bo unref can happen in both mmu callback and a callback 
>> after
>> migrate to system ram. Both are async call in different tasks. Sync 
>> svm_bo
>> unref operation to avoid random "use-after-free".
>>
>> Signed-off-by: Xiaogang.Chen <Xiaogang.Chen@amd.com>
>> ---
>>   drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 9 +++++++++
>>   1 file changed, 9 insertions(+)
>>
>> diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c 
>> b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
>> index 70aa882636ab..8e246e848018 100644
>> --- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
>> +++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
>> @@ -637,6 +637,15 @@ void svm_range_vram_node_free(struct svm_range 
>> *prange)
>>   {
>>       svm_range_bo_unref(prange->svm_bo);
>>       prange->ttm_res = NULL;
> Are above two lines not removed?

you are right, It was caused by copy-paste when edit. I tested it 
without these two lines. I will remove these two lines when send to gerrit.

Thanks

Xiaogang

>
> Regards,
> Eric
>> +     /* serialize prange->svm_bo unref */
>> +     mutex_lock(&prange->lock);
>> +     /* prange->svm_bo has not been unref */
>> +     if (prange->ttm_res) {
>> +             prange->ttm_res = NULL;
>> +             mutex_unlock(&prange->lock);
>> +             svm_range_bo_unref(prange->svm_bo);
>> +     } else
>> +             mutex_unlock(&prange->lock);
>>   }
>>
>>   struct kfd_node *
>