From: Sasha Levin <sashal@kernel.org>
To: patches@lists.linux.dev, stable@vger.kernel.org
Cc: Brian Kocoloski <brian.kocoloski@amd.com>,
Philip Yang <Philip.Yang@amd.com>,
Alex Deucher <alexander.deucher@amd.com>,
Sasha Levin <sashal@kernel.org>,
Felix.Kuehling@amd.com, amd-gfx@lists.freedesktop.org
Subject: [PATCH AUTOSEL 6.18-6.12] drm/amdkfd: Fix improper NULL termination of queue restore SMI event string
Date: Tue, 23 Dec 2025 05:05:14 -0500 [thread overview]
Message-ID: <20251223100518.2383364-10-sashal@kernel.org> (raw)
In-Reply-To: <20251223100518.2383364-1-sashal@kernel.org>
From: Brian Kocoloski <brian.kocoloski@amd.com>
[ Upstream commit 969faea4e9d01787c58bab4d945f7ad82dad222d ]
Pass character "0" rather than NULL terminator to properly format
queue restoration SMI events. Currently, the NULL terminator precedes
the newline character that is intended to delineate separate events
in the SMI event buffer, which can break userspace parsers.
Signed-off-by: Brian Kocoloski <brian.kocoloski@amd.com>
Reviewed-by: Philip Yang <Philip.Yang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 6e7143e5e6e21f9d5572e0390f7089e6d53edf3c)
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
LLM Generated explanations, may be completely bogus:
## Summary
### Technical Analysis
**The Bug:** Commit 663b0f1e141d introduced a refactoring that changed
the inline format string to use the `KFD_EVENT_FMT_QUEUE_RESTORE` macro.
This macro is defined as:
```c
#define KFD_EVENT_FMT_QUEUE_RESTORE(ns, pid, node, rescheduled)\
"%lld -%d %x %c\n", (ns), (pid), (node), (rescheduled)
```
The format specifier `%c` expects a **character**. The buggy code passes
integer `0` (which is the NULL terminator 0x00). When printed with `%c`,
this NULL byte terminates the string before the newline `\n` gets
written, causing:
- Malformed event strings in the SMI buffer
- Userspace parsers expecting newline-delimited events to fail
**The Fix:** Change `0` to `'0'` (ASCII character 0x30 = 48) so the `%c`
format prints the character "0" followed by the newline.
**Evidence the fix is correct:**
1. The sibling function `kfd_smi_event_queue_restore_rescheduled`
correctly uses `'R'` (a character) for the same parameter
2. The format specifier is `%c` which requires a character
3. The original pre-refactoring code had no character parameter at all
(format was `"%lld -%d %x\n"`)
### Stable Kernel Criteria Assessment
| Criteria | Assessment |
|----------|------------|
| Obviously correct | ✅ Yes - format `%c` requires character, `'0'` vs
`0` is clearly the fix |
| Fixes real bug | ✅ Yes - breaks userspace parsers relying on newline-
delimited events |
| Important issue | ✅ Yes - affects userspace ABI/behavior |
| Small and contained | ✅ Yes - 1 line, 1 file, single character change
|
| No new features | ✅ Correct - no new functionality |
| Tested | ✅ Reviewed-by and cherry-picked from mainline |
### Risk Assessment
- **Risk:** Extremely low - the change is trivial and obviously correct
- **Scope:** Only affects AMD GPU users using SMI event monitoring
- **Regression potential:** None - this is restoring correct behavior
### Affected Versions
The bug was introduced in commit 663b0f1e141d which landed in v6.12-rc1.
This fix is relevant for the 6.12.y stable branch.
### Conclusion
This is an ideal stable backport candidate: a small, obvious, low-risk
fix for a user-visible bug that breaks userspace tools. The fix is
trivial (single character), has clear evidence of correctness, and has
been reviewed by AMD engineers. The commit message clearly explains the
problem and the solution.
**YES**
drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c
index a499449fcb06..d2bc169e84b0 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c
@@ -312,7 +312,7 @@ void kfd_smi_event_queue_restore(struct kfd_node *node, pid_t pid)
{
kfd_smi_event_add(pid, node, KFD_SMI_EVENT_QUEUE_RESTORE,
KFD_EVENT_FMT_QUEUE_RESTORE(ktime_get_boottime_ns(), pid,
- node->id, 0));
+ node->id, '0'));
}
void kfd_smi_event_queue_restore_rescheduled(struct mm_struct *mm)
--
2.51.0
next prev parent reply other threads:[~2025-12-23 10:05 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-12-23 10:05 [PATCH AUTOSEL 6.18-5.10] powercap: fix sscanf() error return value handling Sasha Levin
2025-12-23 10:05 ` [PATCH AUTOSEL 6.18-6.6] netfilter: nf_tables: avoid chain re-validation if possible Sasha Levin
2025-12-23 10:12 ` Florian Westphal
2026-01-14 20:00 ` Sasha Levin
2025-12-23 10:05 ` [PATCH AUTOSEL 6.18-6.12] spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ Sasha Levin
2025-12-23 10:05 ` [PATCH AUTOSEL 6.18-5.10] can: j1939: make j1939_session_activate() fail if device is no longer registered Sasha Levin
2025-12-23 10:05 ` [PATCH AUTOSEL 6.18-5.10] powercap: fix race condition in register_control_type() Sasha Levin
2025-12-23 10:05 ` [PATCH AUTOSEL 6.18] block: validate pi_offset integrity limit Sasha Levin
2025-12-23 10:05 ` [PATCH AUTOSEL 6.18-6.6] drm/amd/display: Fix DP no audio issue Sasha Levin
2025-12-23 10:05 ` [PATCH AUTOSEL 6.18-6.12] ata: libata-core: Disable LPM on ST2000DM008-2FR102 Sasha Levin
2025-12-23 10:05 ` [PATCH AUTOSEL 6.18] accel/amdxdna: Block running under a hypervisor Sasha Levin
2025-12-23 10:05 ` Sasha Levin [this message]
2025-12-23 10:05 ` [PATCH AUTOSEL 6.18-6.12] net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20251223100518.2383364-10-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=Felix.Kuehling@amd.com \
--cc=Philip.Yang@amd.com \
--cc=alexander.deucher@amd.com \
--cc=amd-gfx@lists.freedesktop.org \
--cc=brian.kocoloski@amd.com \
--cc=patches@lists.linux.dev \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox