Re: [PATCH 5.15.y] drm/amdgpu: fix usage slab after free

[Sasha Levin <sashal@kernel.org>]

[ Sasha's backport helper bot ]

Hi,

✅ All tests passed successfully. No issues detected.
No action required from the submitter.

The upstream commit SHA1 provided is correct: b61badd20b443eabe132314669bb51a263982e5c

WARNING: Author mismatch between patch and upstream commit:
Backport author: bin.lan.cn@windriver.com
Commit author: Vitaly Prosyak<vitaly.prosyak@amd.com>

Status in newer kernel trees:
6.14.y | Present (exact SHA1)
6.12.y | Present (different SHA1: 6383199ada42)
6.6.y | Present (different SHA1: 3990ef742c06)
6.1.y | Present (different SHA1: 05b1b33936b7)

Note: The patch differs from the upstream commit:
---
1:  b61badd20b443 ! 1:  a9cf4e376c397 drm/amdgpu: fix usage slab after free
    @@ Metadata
      ## Commit message ##
         drm/amdgpu: fix usage slab after free
     
    +    [ Upstream commit b61badd20b443eabe132314669bb51a263982e5c ]
    +
         [  +0.000021] BUG: KASAN: slab-use-after-free in drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched]
         [  +0.000027] Read of size 8 at addr ffff8881b8605f88 by task amd_pci_unplug/2147
     
    @@ Commit message
         Reviewed-by: Christian König <christian.koenig@amd.com>
         Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
         Cc: stable@vger.kernel.org
    +    [Minor context change fixed.]
    +    Signed-off-by: Bin Lan <bin.lan.cn@windriver.com>
    +    Signed-off-by: He Zhe <zhe.he@windriver.com>
     
      ## drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ##
    -@@ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c: void amdgpu_device_fini_sw(struct amdgpu_device *adev)
    - 	int idx;
    - 	bool px;
    +@@ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c: void amdgpu_device_fini_hw(struct amdgpu_device *adev)
      
    + void amdgpu_device_fini_sw(struct amdgpu_device *adev)
    + {
     -	amdgpu_fence_driver_sw_fini(adev);
      	amdgpu_device_ip_fini(adev);
     +	amdgpu_fence_driver_sw_fini(adev);
    - 	amdgpu_ucode_release(&adev->firmware.gpu_info_fw);
    + 	release_firmware(adev->firmware.gpu_info_fw);
    + 	adev->firmware.gpu_info_fw = NULL;
      	adev->accel_working = false;
    - 	dma_fence_put(rcu_dereference_protected(adev->gang_submit, true));
     
      ## drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c ##
     @@ drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c: int amdgpu_vce_sw_fini(struct amdgpu_device *adev)
    @@ drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c: int amdgpu_vce_sw_fini(struct amdgpu_de
      	for (i = 0; i < adev->vce.num_rings; i++)
      		amdgpu_ring_fini(&adev->vce.ring[i]);
      
    - 	amdgpu_ucode_release(&adev->vce.fw);
    + 	release_firmware(adev->vce.fw);
      	mutex_destroy(&adev->vce.idle_mutex);
      
     +	amdgpu_bo_free_kernel(&adev->vce.vcpu_bo, &adev->vce.gpu_addr,
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-5.15.y       |  Success    |  Success   |