Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <9c58cacc-27a5-035e-0c17-2a0e8b30cf54@amd.com>
Date:   Tue, 25 Oct 2022 15:39:38 -0400
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.2.2
Subject: Re: [PATCH -next] drm/amdkfd: Fix NULL pointer dereference in
 svm_migrate_to_ram()
Content-Language: en-US
To:     Yang Li <yang.lee@linux.alibaba.com>, alexander.deucher@amd.com
Cc:     christian.koenig@amd.com, Xinhui.Pan@amd.com, airlied@gmail.com,
        daniel@ffwll.ch, amd-gfx@lists.freedesktop.org,
        dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org,
        Abaci Robot <abaci@linux.alibaba.com>
References: <20221025072822.129940-1-yang.lee@linux.alibaba.com>
From:   Felix Kuehling <felix.kuehling@amd.com>
In-Reply-To: <20221025072822.129940-1-yang.lee@linux.alibaba.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?d1VCN0xNUTQya1NHdk5kSk8vZjUrZ3N2TzZQWDVpN2tEVkJMMjgwSGpiSXBL?=
 =?utf-8?B?OWE5Rm9uWlZsbEQ2bnpqNHhpdkJyU2dGc24xNUJhb3I4UGRxNXBwWXdzL3NJ?=
 =?utf-8?B?ZjJSazJET0swcjZDdGwySEl4YndiYnV5K3N1L0V0d3Q5Y2xCajNRM2Y1UWVq?=
 =?utf-8?B?dzViUElLNXJham5FZ2VnTm9wTW5jc3o4SmE0UmFNQzU2Wk5QbHYxUC9Xc1Bm?=
 =?utf-8?B?T1BpcS83VjArMHN5U1dxV0ZVME0vVVpISzlDdzJpZzBUUURxeGJuTmdoK3Az?=
 =?utf-8?B?K0hQQmhTanI5NnV1QjFYQm82Vk5zOVA2QXplVis0QkFyem1SSDVpOFNUSEEw?=
 =?utf-8?B?Mi9nTmY2MXJZdllRTCsxeHJRMFlETXhyanU5UUh0L1B3MW1uQ2RPZzRKN3Ba?=
 =?utf-8?B?eTNKaUpRL1pSS2lGbmFDdmV5UmlVRllZNjd2M0hnbm5vYVJmcVdXdGJQNTMv?=
 =?utf-8?B?U00zM3hMN216ZUMzS1R5aC9hSExRdDQvV29XMFBjc3dHelcvcWlFMkFTb25x?=
 =?utf-8?B?T3hsc0hmclBYK2c2L29Gdmp6T3NJUFoveDR0V1VxNkFlQ0JCQkp5SE1XQWtl?=
 =?utf-8?B?MnpyTDNOTWpHaisvdjRGbjhiNnVRUFhIUjdBRjlVaCs2eFJ6bGtIK0NQZTJK?=
 =?utf-8?B?Y0E0QVM0QTFtTm1TOHF0aW5tR21PRitVWXVmN1VDeFBGYVJuZm9hdGNHK3lh?=
 =?utf-8?B?aXpTNG1uS2Q0WmlXZkRKYnYwcW9ITGJ4SWZYUHUrb2k3SU5zYzl0TzhRdjU5?=
 =?utf-8?B?M2RXVDk4cGhXMDV3N1JDSXVkQjZ3UTBFM2JyV3NDWWsvM0t2TldhUUI4dWhF?=
 =?utf-8?B?Rm1kejBrdlY0bFpIR2VFajJ4cUo5T2tUOUhhV1Y4cmg3SlVJRit4YVFRSlJH?=
 =?utf-8?B?aDRBOGdNMmxSb0V1eVpaUUFPUWZiTEt0SDljNkUzRGd2bGZMajRjcEJjUmxC?=
 =?utf-8?B?M1BLM2txckU5aWxmVTJpQkVTMmc4NDZGL25qNkhnZm1LMnA3T0dDZVRmR1p2?=
 =?utf-8?B?YU5qWEp1YXQzQnJaK3JZdEx2c1VhSU1LelJPQndGQ0hvaWZHU3R5bVcyVlUx?=
 =?utf-8?B?Y1l4T09RdVViUTAwclBCdUxaNWZzNUUwZ2F1b0Q1dEZXSEhUazZ3ZWhVSGFm?=
 =?utf-8?B?SGgxQXNyaHBsVlJZVXI3bGIzU245MUQ2aHh5a21nb0Y0d1kwWVFpNVVNMlZW?=
 =?utf-8?B?dE03TE1uWUxuWnVrNjZGR3VIdWgxT04rQ3ZiYjNxSnlyTms0UnZmZE5RS2hU?=
 =?utf-8?B?TDYyaVRacU1VeHJjQ3BIYlh6M1Qrb0ptald5SndBN1gyaU5LeFRlVUdCV0FR?=
 =?utf-8?B?K3NZVVpPNjZPWCs3ZGZYekZFc2dvZ3RzQlZIV1AwekJ4bGtCczA0NUJlNHdX?=
 =?utf-8?B?Y0hkTHFKNTRNYm5SeWY3MkJMbkQvZlE1NGZSWXkzZlBPcVlrQ0xHS3J4Q3FQ?=
 =?utf-8?B?Z2UwZWpjK3d5Tk9JcEJPa1I0YUR6M3QvWjI1RmV2WjIvaDlkYXA3RTlCdXQ2?=
 =?utf-8?B?bHBFNWVGUVl3NVpZTGxPQU13Y25WeDU5eHdpQjUwYVBtdnptVnpGVmh2eUFM?=
 =?utf-8?B?WldTK0NYTXBxVWhRTFF2Yi9iVmR1dzRTeEdWS1p1RnNZcTg2U1Y1RWU3MnNs?=
 =?utf-8?B?OVEwNjJNYmV4bnhRS2prc0h6TDA5NlRMK0d2VWcwbzNhRXVGbTVraG5WczZJ?=
 =?utf-8?B?d0k4YzhQM3gyZjh3Z0lDTUlyWmFFYnBDNjB4aU5OYmZtenF0Si9yWHBIRWRM?=
 =?utf-8?B?QVVHaUNkS0k2SElPcjlvZ1k2emFVd2Z4enlCSUV1MDVqb2lkaWVsb0l5N2Mx?=
 =?utf-8?B?L01DcGpvVGl5Wm5kR0V3Vy9vRkViazZXd1IwV1RRYndXQmJ3WFFUTzVYb3N0?=
 =?utf-8?B?d1ZkUStvZFJRczZsd0NPalI1b29NQmFGZHcyWFkvVncwdW9PN1gzeDdQR1ZT?=
 =?utf-8?B?bk9OSXBFV01QejdkR0pkSFpIRWo1MXBwZDNKUkVFUnhQOE5yRWdCWGZWT3FE?=
 =?utf-8?B?M1dyYjU2ejdkWlJaUytKSCtJa1RhMWgrczgvcEVHYlIzNU1INnhOdjg1RXJO?=
 =?utf-8?B?UWxxVDYzNTdTRU1pQytNQWd4SFJYcHh3VzIvUFdTWFAxZ1ljWEhwNy8vZGtH?=
 =?utf-8?Q?RrpqdKqUw1/Hlcp88shsjJTjp?=
X-OriginatorOrg: amd.com
X-MS-Exchange-CrossTenant-Network-Message-Id: ed49cb40-abeb-49e7-f0ec-08dab6c0a889
X-MS-Exchange-CrossTenant-AuthSource: BN9PR12MB5115.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Oct 2022 19:39:40.5809
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: Qk34KpTOuIwqEkUlLRMXG5pr5FBwplVS3XlNEeBop+umed1lWfWVKMrYewYTRUpBJYChvnDdchotK7a7dG3drQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM4PR12MB6326
X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,NICE_REPLY_A,RCVD_IN_DNSWL_NONE,
        RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS,URIBL_BLOCKED autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Am 2022-10-25 um 03:28 schrieb Yang Li:
> ./drivers/gpu/drm/amd/amdkfd/kfd_migrate.c:985:58-62: ERROR: p is NULL but dereferenced.
>
> Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=2549
> Reported-by: Abaci Robot <abaci@linux.alibaba.com>
> Signed-off-by: Yang Li <yang.lee@linux.alibaba.com>
> ---
>   drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
> index cddf259875c0..405dd51521dc 100644
> --- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
> +++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
> @@ -981,7 +981,8 @@ static vm_fault_t svm_migrate_to_ram(struct vm_fault *vmf)
>   out_mmput:
>   	mmput(mm);
>   
> -	pr_debug("CPU fault svms 0x%p address 0x%lx done\n", &p->svms, addr);
> +	if (p)
> +		pr_debug("CPU fault svms 0x%p address 0x%lx done\n", &p->svms, addr);

Thank you for catching and reporting this problem. I think the correct 
solution would be to move the pr_debug up before the kfd_unref_process 
call. That way you're sure that the pointer is initialized and that it 
represents a valid reference to the kfd_process structure.

Regards,
   Felix


>   
>   	return r ? VM_FAULT_SIGBUS : 0;
>   }