From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, "xinhui pan" <xinhui.pan@amd.com>,
"Christian König" <christian.koenig@amd.com>,
"Alex Deucher" <alexander.deucher@amd.com>,
"Sasha Levin" <sashal@kernel.org>
Subject: [PATCH 4.9 53/66] drm/amdgpu: Fix a use-after-free
Date: Mon, 31 May 2021 15:14:26 +0200 [thread overview]
Message-ID: <20210531130637.935427397@linuxfoundation.org> (raw)
In-Reply-To: <20210531130636.254683895@linuxfoundation.org>
From: xinhui pan <xinhui.pan@amd.com>
[ Upstream commit 1e5c37385097c35911b0f8a0c67ffd10ee1af9a2 ]
looks like we forget to set ttm->sg to NULL.
Hit panic below
[ 1235.844104] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b7b4b: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI
[ 1235.989074] Call Trace:
[ 1235.991751] sg_free_table+0x17/0x20
[ 1235.995667] amdgpu_ttm_backend_unbind.cold+0x4d/0xf7 [amdgpu]
[ 1236.002288] amdgpu_ttm_backend_destroy+0x29/0x130 [amdgpu]
[ 1236.008464] ttm_tt_destroy+0x1e/0x30 [ttm]
[ 1236.013066] ttm_bo_cleanup_memtype_use+0x51/0xa0 [ttm]
[ 1236.018783] ttm_bo_release+0x262/0xa50 [ttm]
[ 1236.023547] ttm_bo_put+0x82/0xd0 [ttm]
[ 1236.027766] amdgpu_bo_unref+0x26/0x50 [amdgpu]
[ 1236.032809] amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x7aa/0xd90 [amdgpu]
[ 1236.040400] kfd_ioctl_alloc_memory_of_gpu+0xe2/0x330 [amdgpu]
[ 1236.046912] kfd_ioctl+0x463/0x690 [amdgpu]
Signed-off-by: xinhui pan <xinhui.pan@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
index 7271e3f32d82..ab041ae58b20 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
@@ -886,6 +886,7 @@ static void amdgpu_ttm_tt_unpopulate(struct ttm_tt *ttm)
if (gtt && gtt->userptr) {
kfree(ttm->sg);
+ ttm->sg = NULL;
ttm->page_flags &= ~TTM_PAGE_FLAG_SG;
return;
}
--
2.30.2
next prev parent reply other threads:[~2021-05-31 13:24 UTC|newest]
Thread overview: 69+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-31 13:13 [PATCH 4.9 00/66] 4.9.271-rc1 review Greg Kroah-Hartman
2021-05-31 13:13 ` [PATCH 4.9 01/66] mm, vmstat: drop zone->lock in /proc/pagetypeinfo Greg Kroah-Hartman
2021-05-31 13:13 ` [PATCH 4.9 02/66] tweewide: Fix most Shebang lines Greg Kroah-Hartman
2021-05-31 13:13 ` [PATCH 4.9 03/66] scripts: switch explicitly to Python 3 Greg Kroah-Hartman
2021-05-31 13:13 ` [PATCH 4.9 04/66] netfilter: x_tables: Use correct memory barriers Greg Kroah-Hartman
2021-05-31 13:13 ` [PATCH 4.9 05/66] NFC: nci: fix memory leak in nci_allocate_device Greg Kroah-Hartman
2021-05-31 13:13 ` [PATCH 4.9 06/66] NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return() Greg Kroah-Hartman
2021-05-31 13:13 ` [PATCH 4.9 07/66] proc: Check /proc/$pid/attr/ writes against file opener Greg Kroah-Hartman
2021-05-31 13:13 ` [PATCH 4.9 08/66] net: hso: fix control-request directions Greg Kroah-Hartman
2021-05-31 13:13 ` [PATCH 4.9 09/66] mac80211: assure all fragments are encrypted Greg Kroah-Hartman
2021-05-31 13:13 ` [PATCH 4.9 10/66] mac80211: prevent mixed key and fragment cache attacks Greg Kroah-Hartman
2021-05-31 13:13 ` [PATCH 4.9 11/66] cfg80211: mitigate A-MSDU aggregation attacks Greg Kroah-Hartman
2021-05-31 13:13 ` [PATCH 4.9 12/66] mac80211: check defrag PN against current frame Greg Kroah-Hartman
2021-05-31 13:13 ` [PATCH 4.9 13/66] ath10k: Validate first subframe of A-MSDU before processing the list Greg Kroah-Hartman
2021-05-31 13:13 ` [PATCH 4.9 14/66] dm snapshot: properly fix a crash when an origin has no snapshots Greg Kroah-Hartman
2021-05-31 13:13 ` [PATCH 4.9 15/66] kgdb: fix gcc-11 warnings harder Greg Kroah-Hartman
2021-05-31 13:13 ` [PATCH 4.9 16/66] misc/uss720: fix memory leak in uss720_probe Greg Kroah-Hartman
2021-05-31 13:13 ` [PATCH 4.9 17/66] mei: request autosuspend after sending rx flow control Greg Kroah-Hartman
2021-05-31 13:13 ` [PATCH 4.9 18/66] staging: iio: cdc: ad7746: avoid overwrite of num_channels Greg Kroah-Hartman
2021-05-31 13:13 ` [PATCH 4.9 19/66] iio: adc: ad7793: Add missing error code in ad7793_setup() Greg Kroah-Hartman
2021-05-31 13:13 ` [PATCH 4.9 20/66] USB: trancevibrator: fix control-request direction Greg Kroah-Hartman
2021-05-31 13:13 ` [PATCH 4.9 21/66] serial: rp2: use request_firmware instead of request_firmware_nowait Greg Kroah-Hartman
2021-05-31 13:13 ` [PATCH 4.9 22/66] USB: serial: ti_usb_3410_5052: add startech.com device id Greg Kroah-Hartman
2021-05-31 13:13 ` [PATCH 4.9 23/66] USB: serial: option: add Telit LE910-S1 compositions 0x7010, 0x7011 Greg Kroah-Hartman
2021-05-31 13:13 ` [PATCH 4.9 24/66] USB: serial: ftdi_sio: add IDs for IDS GmbH Products Greg Kroah-Hartman
2021-05-31 13:13 ` [PATCH 4.9 25/66] USB: serial: pl2303: add device id for ADLINK ND-6530 GC Greg Kroah-Hartman
2021-05-31 13:13 ` [PATCH 4.9 26/66] net: usb: fix memory leak in smsc75xx_bind Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 27/66] spi: Fix use-after-free with devm_spi_alloc_* Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 28/66] Bluetooth: cmtp: fix file refcount when cmtp_attach_device fails Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 29/66] NFS: fix an incorrect limit in filelayout_decode_layout() Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 30/66] NFS: Dont corrupt the value of pg_bytes_written in nfs_do_recoalesce() Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 31/66] NFSv4: Fix v4.0/v4.1 SEEK_DATA return -ENOTSUPP when set NFS_V4_2 config Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 32/66] net/mlx4: Fix EEPROM dump support Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 33/66] Revert "net:tipc: Fix a double free in tipc_sk_mcast_rcv" Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 34/66] tipc: skb_linearize the head skb when reassembling msgs Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 35/66] i2c: s3c2410: fix possible NULL pointer deref on read message after write Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 36/66] i2c: i801: Dont generate an interrupt on bus reset Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 37/66] perf jevents: Fix getting maximum number of fds Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 38/66] platform/x86: hp_accel: Avoid invoking _INI to speed up resume Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 39/66] serial: max310x: unregister uart driver in case of failure and abort Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 40/66] net: fujitsu: fix potential null-ptr-deref Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 41/66] net: caif: remove BUG_ON(dev == NULL) in caif_xmit Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 42/66] char: hpet: add checks after calling ioremap Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 43/66] ALSA: sb8: Add a comment note regarding an unused pointer Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 44/66] isdn: mISDNinfineon: check/cleanup ioremap failure correctly in setup_io Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 45/66] dmaengine: qcom_hidma: comment platform_driver_register call Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 46/66] libertas: register sysfs groups properly Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 47/66] media: dvb: Add check on sp8870_readreg return Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 48/66] media: gspca: properly check for errors in po1030_probe() Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 49/66] scsi: BusLogic: Fix 64-bit system enumeration error for Buslogic Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 50/66] openrisc: Define memory barrier mb Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 51/66] btrfs: do not BUG_ON in link_to_fixup_dir Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 52/66] platform/x86: intel_punit_ipc: Append MODULE_DEVICE_TABLE for ACPI Greg Kroah-Hartman
2021-05-31 13:14 ` Greg Kroah-Hartman [this message]
2021-05-31 13:14 ` [PATCH 4.9 54/66] net: netcp: Fix an error message Greg Kroah-Hartman
2021-05-31 18:43 ` Marion & Christophe JAILLET
2021-05-31 13:14 ` [PATCH 4.9 55/66] net: mdio: thunder: Fix a double free issue in the .remove function Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 56/66] net: mdio: octeon: Fix some double free issues Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 57/66] net: bnx2: Fix error return code in bnx2_init_board() Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 58/66] mld: fix panic in mld_newpack() Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 59/66] staging: emxx_udc: fix loop in _nbu2ss_nuke() Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 60/66] ASoC: cs35l33: fix an error code in probe() Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 61/66] scsi: libsas: Use _safe() loop in sas_resume_port() Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 62/66] sch_dsmark: fix a NULL deref in qdisc_reset() Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 63/66] MIPS: alchemy: xxs1500: add gpio-au1000.h header file Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 64/66] MIPS: ralink: export rt_sysc_membase for rt2880_wdt.c Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 65/66] hugetlbfs: hugetlb_fault_mutex_hash() cleanup Greg Kroah-Hartman
2021-05-31 13:14 ` [PATCH 4.9 66/66] usb: core: reduce power-on-good delay time of root hub Greg Kroah-Hartman
2021-06-01 2:13 ` [PATCH 4.9 00/66] 4.9.271-rc1 review Florian Fainelli
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210531130637.935427397@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=alexander.deucher@amd.com \
--cc=christian.koenig@amd.com \
--cc=linux-kernel@vger.kernel.org \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
--cc=xinhui.pan@amd.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox