From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f172.google.com (mail-pl1-f172.google.com [209.85.214.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 053C2288D0 for ; Sun, 9 Aug 2026 08:49:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786265349; cv=none; b=XBTo/EfUKlhaIcNwYxMu7UkN/o9XzX4yL9OvZ7VavCNOupS43PfrUGuEIUZDaQsBflyYcIdd0+WvxexvBG89x2oRdA+H+RbFvPLPcsVX4n7WfHlOTVU8S694B3m1yAI2wLAL3YQvD2qlEhLohOdrkiWQxVNqSL5AsUIeF5rEryc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786265349; c=relaxed/simple; bh=aDj5aLG7NStNslfYhTIl3YYv6XZgFNUFXK8u7qYzlf0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=a16wPZ2MljVRzKrQ2TQc+zv5vgUlK7AQDF48GFrOUgJsM+7Z8bMdgbGuc7pJFo6tcAIQw4GvJiiR7Qcusv+xIjHZYDj28vytsjupmY5SWP4u6woFypcr+INkKzs0cUyVnCFTu1Ha0TelmTCXxYdch92fdZPtCo/FwLeLj9Mau3s= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=KV1YkOYB; arc=none smtp.client-ip=209.85.214.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="KV1YkOYB" Received: by mail-pl1-f172.google.com with SMTP id d9443c01a7336-2cace91f112so8802745ad.0 for ; Sun, 09 Aug 2026 01:49:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786265347; x=1786870147; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=A3BeIAtfJ2/omVu82I5VMk45uIa8CTiHrIT/44X40ds=; b=KV1YkOYBupWUgWgNtlRGiBYDULkjyE8AILK1NUpjGDPbpEU+4T4Utx+Vb6DVNHQ7kO dXh2iE+KbfXxX9bTa9Q5177KbNWES8rUfl0Y1KPIgFTrSPWSjoj3ej8zETwWinTGR6C9 EpgvJ20Yl4FybUW051gkTTP0+u4+kY3GXVWQgX/15GeErcG74mlcpPlJJsPesaRVxoRW 4E4caw868Fn1W+CQzN0HGBxeOAr2W//JkaGaoVr9UdbkHT51X3MEYeLBD5eq53XK6A5C UERcvCtRudXWYM6wnvYfNmG4sJV5WxD8+vBN+Yc2UX2PNyb8N8Gxkc+gyCqfH4aRP2WL cPEA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786265347; x=1786870147; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=A3BeIAtfJ2/omVu82I5VMk45uIa8CTiHrIT/44X40ds=; b=og+kN9aSH8Q210HVCWbdJctiB8mIGU4D/ElMIN9RxBYfucynvJ6sB7Ss3/6dPcln2x eiAjxkMxNfFudZsqnoMtFIPKo6q1IjlCkb/ChHoua4kDiT+jvNVTrnfD/z9up8UpPmBD IXO3R328T4+snFqlVNvtgVNRpgqYK2qT+6E++vPO+rCkG11CpqdeXH0+BfnOmWuT9vQJ J3TbxCCm5eSVnFb7DAGP36W7vOeJm7uO63ndhlG0yXjHMp1a2xiB5bcR4RiEira4r24g HDajmuQCZwPdS2OImDaOeY8RN2QVrM/X3BpheRkUEUYLHeOxjIjwej5aU7yaQAEiJOoW IkoA== X-Forwarded-Encrypted: i=1; AHgh+RqPOtmGB8rJvYAA6as3ZNEsEVTVCke0axh50OFC89/k6rpXhMPJ0Ay8scYPFKIBM/4JSDiamWmO5IYh0jA=@vger.kernel.org X-Gm-Message-State: AOJu0YzkRc2dpW3mBvSaYZoZAuVSDcepz4EHkXpwJO8i3J8E6KD2xvKF bB0QbPwcqjCIYti4cN7gdfhTexg/kIXhBDDw+S8JagBikG+GOQFU0k8F X-Gm-Gg: AR+sD13iBIRVqPWhdXZ+guXpSEKpfvj21Br09x2eAzhXXsXfU51PkcoDNKdBChC06eM z3Q1fWdLCXwRr2HdOJwk5M+LSaEGo+7tDy8CdNDVQjfJ0fxcfipHGbhPeBftQMP/C8Bb99CBRl5 jk7jgxQZHTfy6sRQeVduqSVTnrFQrEBcelLBkRpneVKxEqLq29OxTmALrb4GDnCRQgCutiLfhl9 wUyZ/YW97jXpB4V8YJ3rtKM6yfEFdYkl8UBw1GcickrTslC50DR37X6q+1be98vHzB4Ra9ElHQG QNaJKW11s+rS1JA7PJqQ6EZTwmmjz4MwXLGs+Pk8qcwdqJ6f9pP8eBXIM2Juub9JtjKRfgYLKqW L4oRivevqISNDjKpfPv2R26uEpYYX5Zcq5CSaueddbPyRDc/dzgRKRx+G2I9/UF0QJBweF2cMfa jRWM+ZO78N2qjvpAvKbN4tmiX2qnCvaQ6c+hwoAHKAUPfI8D1rIgw3LYRHJbXC6zOeoaMbPu0le ETbdETNawI= X-Received: by 2002:a05:6a20:9e0e:b0:3c3:66c5:68cc with SMTP id adf61e73a8af0-3cb85efa4f9mr44179451637.21.1786265347177; Sun, 09 Aug 2026 01:49:07 -0700 (PDT) Received: from localhost.localdomain ([103.178.205.91]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-315be86fc7bsm28800025eec.1.2026.08.09.01.49.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Aug 2026 01:49:06 -0700 (PDT) From: Sreeraj S Kurup To: alexander.deucher@amd.com, christian.koenig@amd.com Cc: amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, airlied@gmail.com, simona@ffwll.ch, Sreeraj S Kurup Subject: [PATCH v4 1/6] drm/amdgpu/aca: Fix race condition and UAF in error cache logging Date: Sun, 9 Aug 2026 08:47:30 +0000 Message-ID: <20260809084735.9743-2-sreekuttan2156239@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260809084735.9743-1-sreekuttan2156239@gmail.com> References: <20260809084735.9743-1-sreekuttan2156239@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit In aca_error_cache_log_bank_error(), find_bank_error() released aerr->lock prior to returning bank_error. This created a time-of-check to time-of-use (TOCTOU) race window where a concurrent caller of aca_log_aca_error() could acquire aerr->lock and free the bank_error node via aca_bank_error_remove(). When execution returned to aca_error_cache_log_bank_error(), incrementing bank_error->count resulted in a Use-After-Free and potential kernel memory corruption. Additionally, bank_error->count was updated outside mutex lock protection. Fix this by acquiring aerr->lock at the start of aca_error_cache_log_bank_error() and holding it continuously across lookup, creation, and counter updates, while removing redundant internal lock acquisitions in helper functions. Signed-off-by: Sreeraj S Kurup --- drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c index db7858fe0c3d..d0d473082431 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c @@ -237,10 +237,8 @@ static struct aca_bank_error *new_bank_error(struct aca_error *aerr, struct aca_ INIT_LIST_HEAD(&bank_error->node); memcpy(&bank_error->info, info, sizeof(*info)); - mutex_lock(&aerr->lock); list_add_tail(&bank_error->node, &aerr->list); aerr->nr_errors++; - mutex_unlock(&aerr->lock); return bank_error; } @@ -249,22 +247,16 @@ static struct aca_bank_error *find_bank_error(struct aca_error *aerr, struct aca { struct aca_bank_error *bank_error = NULL; struct aca_bank_info *tmp_info; - bool found = false; - mutex_lock(&aerr->lock); list_for_each_entry(bank_error, &aerr->list, node) { tmp_info = &bank_error->info; if (tmp_info->socket_id == info->socket_id && tmp_info->die_id == info->die_id) { - found = true; - goto out_unlock; + return bank_error; } } -out_unlock: - mutex_unlock(&aerr->lock); - - return found ? bank_error : NULL; + return NULL; } static void aca_bank_error_remove(struct aca_error *aerr, struct aca_bank_error *bank_error) @@ -306,11 +298,15 @@ int aca_error_cache_log_bank_error(struct aca_handle *handle, struct aca_bank_in return 0; aerr = &error_cache->errors[type]; + mutex_lock(&aerr->lock); bank_error = get_bank_error(aerr, info); - if (!bank_error) + if (!bank_error) { + mutex_unlock(&aerr->lock); return -ENOMEM; + } bank_error->count += count; + mutex_unlock(&aerr->lock); return 0; } -- 2.54.0