Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <20210531130657.971257589@linuxfoundation.org> <20210531130704.193621612@linuxfoundation.org>
In-Reply-To: <20210531130704.193621612@linuxfoundation.org>
From:   Krzysztof Kozlowski <krzk@kernel.org>
Date:   Thu, 29 Jul 2021 09:58:38 +0200
Message-ID: <CAJKOXPeD7_sE4H7b3ZUYFrQmH4w4H_Npzs5NVL-cgqWYLjPW+Q@mail.gmail.com>
Subject: Re: [PATCH 5.10 182/252] drm/amd/amdgpu: fix refcount leak
To:     Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Jingwen Chen <Jingwen.Chen2@amd.com>,
        Alex Deucher <alexander.deucher@amd.com>
Cc:     "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "stable@vger.kernel.org" <stable@vger.kernel.org>,
        =?UTF-8?Q?Christian_K=C3=B6nig?= <christian.koenig@amd.com>,
        Sasha Levin <sashal@kernel.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Mon, 31 May 2021 at 16:06, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> From: Jingwen Chen <Jingwen.Chen2@amd.com>
>
> [ Upstream commit fa7e6abc75f3d491bc561734312d065dc9dc2a77 ]
>
> [Why]
> the gem object rfb->base.obj[0] is get according to num_planes
> in amdgpufb_create, but is not put according to num_planes
>
> [How]
> put rfb->base.obj[0] in amdgpu_fbdev_destroy according to num_planes
>
> Signed-off-by: Jingwen Chen <Jingwen.Chen2@amd.com>
> Acked-by: Christian K=C3=B6nig <christian.koenig@amd.com>
> Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
>  drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c | 3 +++
>  1 file changed, 3 insertions(+)

The original commit looks like a partial fix for 37ac3dc00da0
("drm/amdgpu: Use device specific BO size & stride check.") which came
in v5.14. Or putting it differently: this does not look entirely good
without 37ac3dc00da0 which is a fix for f258907fdd83 ("drm/amdgpu:
Verify bo size can fit framebuffer size on init.") merged in v5.13.

Backporting it earlier might cause use-after-free errors (due to GEM
refcnt dropping too early).

Can the AMD guys:
1. Confirm where this should be backported (for example not for v4.19,
v5.4, v5.10, v5.12)?
2. Mark fixes with the "Fixes" tag so we know where the fix should go?
Please include such checks in your Acking and Reviewing (unless Acks
and Reviews are just formality, not a check).

Best regards,
Krzysztof