From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7A73260A6F6F for ; Tue, 27 Oct 2026 22:39:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=lists.infradead.org header.i=@lists.infradead.org header.a=rsa-sha256 header.s=bombadil.20210309 header.b=NbVZBxAp; dkim=fail reason="signature verification failed" (2048-bit key, unprotected) header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20260707 header.b=Bfstkr3J DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:Cc:To:From:Subject:Message-ID: References:Mime-Version:In-Reply-To:Date:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Unsubscribe-Post:List-Owner; bh=NYP7BIvHeMc9Qwe1yJhLR9LpeFcNVKbhIdqwCcop9bA=; b=NbVZBxApPglgBjyXkHXdD9vT9a cUVL0qQ8SSSqcwV/5vKx8DnLY1PLQnupFh+qAtXeEQ4ORKfjYowCmoWTkngVIVzY0duZxjdCX/I9t GLypmwJBtRL1VUxKiOb7/vKrGESsscF4c1yrjiiIspHXg8hPeFyHrNz9bjIzTVxR5zAb/aefMwMak 34FBd83Cbr5183xFRjAC13QzzSPqb21TnGGyte3Yy7OuXyyJH9R1WQbKxP1aWZQx9ewPr6Bj8rY3T 6eGeBwOr5qP5LRXm/LOygmzKclC49hWYLd0XwOfO6/0LRLaLiRfQufy1mMK2efLyaqbK0JLH3vBk3 GUMbNHXw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.100.1 #2 (Red Hat Linux)) id 1xLppR-00000005rG1-0CdM; Tue, 27 Oct 2026 22:39:37 +0000 Received: from mail-dy1-x1347.google.com ([2607:f8b0:4864:20::1347]) by bombadil.infradead.org with esmtps (Exim 4.100.1 #2 (Red Hat Linux)) id 1xLppN-00000005rCD-47Df for linux-mtd@lists.infradead.org; Tue, 27 Oct 2026 22:39:35 +0000 Received: by mail-dy1-x1347.google.com with SMTP id 5a478bee46e88-35cbea41088so456575eec.1 for ; Tue, 27 Oct 2026 15:39:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20260707; t=1793140772; x=1793745572; darn=lists.infradead.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=MTMJFM/nqHoym7HFBiG90k6OXEIlh5WHZZg+1coUz9A=; b=Bfstkr3JrzAXsXTBfAJBYTBXLhCBMz/qoJ5rLGw69xbF0roDh1kh/xgE30sTz2nydY BAwrd0MkV2xTLvv0Tphw+S+ITz6CFo0WRa7wJddkZeqRmiY0wimPzalSDgxQ3XcgiCEz DXy+uj6r14xR9M75UWhPgY32j7MiFwynZ4uJfrPnCLUDdxkGVotYP4csoF/b+PbTTsTA sRGRi8ZIX2Qn9GaEYB/EPDFQbNKXjxA60BAukwVoKZYvYPecNSZKFgmfk97ZLT0coi5d LwYizfAmm4fatnWmjFHnjTWP3u46UswWZ53Xg0h+X50NrE+Zgoe/H6GY2B9ZgY++A/QO Hl/w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793140772; x=1793745572; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=MTMJFM/nqHoym7HFBiG90k6OXEIlh5WHZZg+1coUz9A=; b=kYOhkWnaVyM2aRsw25EwfQ3zaxz9bZ0ExH1PNs6/RLhXfafxt79o1unH8H6cMkNZiP +AjcB8XwwFtg7+3l9UM1qsONVkSJQeHPrrRU2oMslEz3REM90gThOlbJIFd7u2QPysk+ umfuDqm4Gjk//8jphxomplcgKcxsFvnRErSrwOkSzlGgv7mGq1w4ZWdgAccn5NGrgCuj SFoIs996LBgUmTwWS4gMNxI4qli9fejUqbgTcLiTYIT6ZfGfMmfMnGlgb45pk03/KDy4 pyVyjq1ieVAVWqptIXjbW3msu7CvOKzx6JKRYUMiH3R/6RnaPnp8Ha9eF147DKFXbaeO ErPA== X-Forwarded-Encrypted: i=1; AKwUvBzx8rl9P3to5OuUweEpULqurHcMvi75UHxaAIhoudvLCGah82UvEAWdNuSfp/iZSHoDkcd8krGZddE=@lists.infradead.org X-Gm-Message-State: AFq9FYK12Z/vRKh6FYxE2F2oZH2JSPfoI1A0taIO/T5gAHEMx3EE8i5i GTT4DDGFqM0ZwpBFL7AWrTxyZSoum4f1S4RLr6Pe+FvMbzzd7KXCC7P5ZxWJGcrsXyb2WWGkAWh eS8k/93S2+w== X-Received: from dlea12-n1.prod.google.com ([2002:a05:701b:420c:10b0:1a4:c892:b166]) (user=irogers job=prod-delivery.src-stubby-dispatcher) by 2002:a05:701b:2813:b0:143:6525:f9f6 with SMTP id a92af1059eb24-1a6cd3a1575mr630918c88.13.1793140772067; Tue, 27 Oct 2026 15:39:32 -0700 (PDT) Date: Tue, 27 Oct 2026 15:38:43 -0700 In-Reply-To: <20261027223847.652884-1-irogers@google.com> X-Archived-By: Mime-Version: 1.0 References: <20261027223847.652884-1-irogers@google.com> X-Mailer: git-send-email 2.56.0.313.g2479322e68-goog Message-ID: <20261027223847.652884-9-irogers@google.com> Subject: [PATCH v2 8/9] drm/amdkfd: Free queue in procfs_queue_type kobject release callback From: Ian Rogers To: Kees Cook , Greg Kroah-Hartman , Miguel Ojeda , "Rafael J . Wysocki" , Danilo Krummrich Cc: Nathan Chancellor , Nick Desaulniers , Miguel Ojeda , "=?UTF-8?q?Christian=20K=C3=B6nig?=" , Zhihao Cheng , Zhongqiu Han , Sumanth Korikkar , Bill Wendling , Justin Stitt , driver-core@lists.linux.dev, llvm@lists.linux.dev, linux-hardening@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-doc@vger.kernel.org, linux-acpi@vger.kernel.org, linux-pm@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-sh@vger.kernel.org, linux-s390@vger.kernel.org, gfs2@lists.linux.dev, xen-devel@lists.xenproject.org, linux-mtd@lists.infradead.org, amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Ian Rogers , Felix Kuehling , Alex Deucher , David Airlie , Simona Vetter , Amber Lin X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.9.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20261027_153934_028670_33622293 X-CRM114-Status: GOOD ( 14.68 ) X-Spam-Score: -9.5 (---------) X-BeenThere: linux-mtd@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Linux MTD discussion mailing list List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-mtd" X-Spam-Status: No, score=-17.2 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_ADSP_CUSTOM_MED,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_EF, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=4.0.1 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on aws-us-west-2-korg-listserv-alma10-1 struct queue embeds a struct kobject (q->kobj) for procfs entries, but procfs_queue_type had no .release callback and uninit_queue() freed q immediately after kfd_procfs_del_queue() called kobject_put(&q->kobj). With CONFIG_DEBUG_KOBJECT_RELEASE=y, this causes a use-after-free. Add kfd_procfs_queue_release() to free struct queue from the kobject release callback, change kfd_procfs_del_queue() to only remove the kobject from sysfs via kobject_del(), and drop the final reference in uninit_queue() via kobject_put(). Check q->kobj.state_in_sysfs before calling kobject_del() in kfd_procfs_del_queue() to avoid warnings if sysfs creation previously failed. Fixes: 6d220a7e7971 ("drm/amdkfd: Add queue information to sysfs") Signed-off-by: Ian Rogers --- drivers/gpu/drm/amd/amdkfd/kfd_process.c | 12 +++++++++--- drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 5 ++++- 2 files changed, 13 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c index 226f52626e84..8e6136d52a50 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c @@ -512,7 +512,15 @@ static const struct sysfs_ops procfs_queue_ops = { .show = kfd_procfs_queue_show, }; +static void kfd_procfs_queue_release(struct kobject *kobj) +{ + struct queue *q = container_of(kobj, struct queue, kobj); + + kfree(q); +} + static const struct kobj_type procfs_queue_type = { + .release = kfd_procfs_queue_release, .sysfs_ops = &procfs_queue_ops, .default_groups = procfs_queue_groups, }; @@ -552,7 +560,6 @@ int kfd_procfs_add_queue(struct queue *q) if (ret < 0) { pr_warn("Creating proc//queues/%u failed", q->properties.queue_id); - kobject_put(&q->kobj); return ret; } @@ -697,11 +704,10 @@ static void kfd_procfs_add_sysfs_files(struct kfd_process *p) void kfd_procfs_del_queue(struct queue *q) { - if (!q || !q->process->kobj) + if (!q || !q->process || !q->process->kobj || !q->kobj.state_in_sysfs) return; kobject_del(&q->kobj); - kobject_put(&q->kobj); } int kfd_process_create_wq(void) diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c index ae3e7c54014a..4666110aebe0 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c @@ -83,7 +83,10 @@ int init_queue(struct queue **q, const struct queue_properties *properties) void uninit_queue(struct queue *q) { - kfree(q); + if (q && q->kobj.state_initialized) + kobject_put(&q->kobj); + else + kfree(q); } #if IS_ENABLED(CONFIG_HSA_AMD_SVM) -- 2.56.0.313.g2479322e68-goog ______________________________________________________ Linux MTD discussion mailing list http://lists.infradead.org/mailman/listinfo/linux-mtd/