Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <1435aa84-c45c-43ca-eac9-d9f85ebcf224@amd.com>
Date:   Thu, 11 May 2023 17:12:43 -0400
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.10.0
Subject: Re: [PATCH v2] drm/amdkfd: Fix potential deallocation of previously
 deallocated memory.
Content-Language: en-US
To:     Daniil Dulov <d.dulov@aladdin.ru>
Cc:     Alex Deucher <alexander.deucher@amd.com>,
        =?UTF-8?Q?Christian_K=c3=b6nig?= <christian.koenig@amd.com>,
        David Airlie <airlied@linux.ie>,
        Daniel Vetter <daniel@ffwll.ch>, Oak Zeng <oak.zeng@intel.com>,
        amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org,
        linux-kernel@vger.kernel.org, "# v5 . 3+" <stable@vger.kernel.org>,
        lvc-project@linuxtesting.org
References: <20230511112314.29322-1-d.dulov@aladdin.ru>
From:   Felix Kuehling <felix.kuehling@amd.com>
Organization: AMD Inc.
In-Reply-To: <20230511112314.29322-1-d.dulov@aladdin.ru>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?YXhzUXE0MWltaTVnRURxZFlqa2t1clZRcHlNY2paTTZKbVdQcE0zeDJCRWwv?=
 =?utf-8?B?aEU0bmZ5RTM2NFE1Z0g3cjVEeXFVOGRSY3ZicUhKUEZMMVhhNzEwYnRwd3hl?=
 =?utf-8?B?UHo0OFVaRXNRQlBLRWViTHN1Nms5bVNlZVJRMGUxd2Q5Ym5RR3dtb3BpTk81?=
 =?utf-8?B?QmhxQnhWbjNkQXMyMlk3cUdSM0FFTHdSQWpIcFZ6R2tpTjJaeVZ5Nm52OCtH?=
 =?utf-8?B?Rm1iMmgyTGVtbmFFejhycnpNZFNaR0tiQnZCak9BUi9SRE5KQTFoYnFsdUNG?=
 =?utf-8?B?a2VteEdFZzZlQ1R4b0R2WWRTZUFCL05iWVd0NklRVXFtSWw5YStYU0R2Y2th?=
 =?utf-8?B?b2NZdWorazZjYk80YitPaTJpRlRzZnU2Vk5PYmp3WmxHWWl6RE1NTUFwSDMz?=
 =?utf-8?B?UU0vTTVyWFYweU9OMlhsRFVzeWp3ZHlPUDVWaVJITHU1YzVONkVWUUJiUVdw?=
 =?utf-8?B?MFgzSm8xTVp1KytKUXdPKzZFZUhINlpkUk40SE5BMGFHWEJBL3ErdFV2d0Nl?=
 =?utf-8?B?N3NnTmE4Z082T0dyWEdndkRnazJxNS9KalJYeGhUOHgzWnR5TnV3K0xxUktH?=
 =?utf-8?B?NVFJS3c3Uis5NzBtN09HTUxhbE9KajAyZ1IyV04zQ1ZxQWlMQXF5T2pYYUVv?=
 =?utf-8?B?T2ltU0R1ZlhETk5KV0xwcCtwbVM3LzlVODNFbkdDcTRyUGlzbWE3Y09haVBx?=
 =?utf-8?B?Nm1BS0RHY0cyYWdnRDBITFJHTGpjMjk5dWMybGdzZ2x6Qm1xN1VRVTRDWHQ0?=
 =?utf-8?B?MVhLSjFYMER6UUpudG1rVnBlbDU0U3VVODNoZFFad01GZnoyL0ZVeUNYMTlw?=
 =?utf-8?B?d1BrUERMc3Mraml3SmJzaXZRa3J3bjdBODVUSVZ0Qmg5VDhETWYrY3l0Wnl3?=
 =?utf-8?B?NUZPWG42NmVraWpaL2MzUmFHYm5KMWt2VmNWZngyaDFWcFI4YW5IaUtUMUk5?=
 =?utf-8?B?WWVhQlh1emdUSDd5ck1nQm40cjY3NC9oL3d2N0dScjlIczBQeG1tREJwMzEv?=
 =?utf-8?B?VFR5OHRmcGpOR24xZUlCNVg5Tm1hell4RFlQZk1UdGpEbTZEQVdQUE9nQXda?=
 =?utf-8?B?b0lkNmx3SU9rZEYxUUkzK3dva0d5MC9odGhlUFYydmE0MER4U0hvYVRxOTZz?=
 =?utf-8?B?VGlLSStoRWVIM05ZZXo1TWxnTzZTbGRoNnUwclJHYWl3WXNTWUdvek8zWjFO?=
 =?utf-8?B?TWxrN05HVWpiM1dOd08vVTh3T3ZGViswdnNSZ3RFMzllbTBaQkI0ZGJab0hr?=
 =?utf-8?B?UFZuKzdoV3N1TEswQU5lNHNKU0JrOTdUQ2lmalVuck5MazVjSTNrd25nSTVN?=
 =?utf-8?B?a3VTTHM1R3BRbjkxNHl3eEFGKy85cDQ3dmVEWjFYR01vb3JrNVJ6VVF2OUNU?=
 =?utf-8?B?QThRVDJpSFBNQzkyOGorZk82RFNNYjJpRkxsZ2l5RGtwaTl0aDNleVJ5ajFD?=
 =?utf-8?B?Y1pxYnZUR1BCaFd4SEpyNmhIQjdGeHBOb0FZNGp4K1dUNjhxNmVtWG45Q2hI?=
 =?utf-8?B?OTYyUzBNL0g1SlBwNUZwT3dHOXhoa3lSelVrVjJ1bnFqNUtJNWV1MEprNkdw?=
 =?utf-8?B?VTZQbC8xakIvSVZuMGM0SlJLSmxualRnN3NGU2RnUnBDTE1lVjkxQ0dFdEV0?=
 =?utf-8?B?M1l4V2htWkFTZkI1NjFJcmxXQng1VjlRbWh3RjNESGpSek50MDdvSFZNQ25E?=
 =?utf-8?B?U1VVcGVUK2VFQm8wUkxRM2ZTVTFuR1RxNEZ1WWNGRjB6RkM2cklQR1dMUzNI?=
 =?utf-8?B?TmdDdGlCaW0ycmZXaDQ0Q1VBS0NYQ2dQUXdaVUZGbHU5bTlkNWRKbFV0SC8z?=
 =?utf-8?B?RzU4QjlQSEJzSEhoQmdNUEUyTDlFOWdCR2ErVit3U0pmMGRsRi81WjhpRkcy?=
 =?utf-8?B?OVBBcFE2ci8zTEM0MzM1am9kOWZvZEpQak5JcGFQMVlHdVg4aXJoVGpJK0tJ?=
 =?utf-8?B?R3VQVnlRaHlETkdJeGJNRUJaaURZdHB3NkpTdExDSzNkelp0Y2hLZU1EYjBG?=
 =?utf-8?B?cUN2SExPeWVrQTBoQlJNeHpVV0gvMEExZW8wRHlKdFg2eDMyY2FONVJXVmpG?=
 =?utf-8?B?T3U4WnN3S003ZUNyMkpjREZxNGNLVUhvblp4N3VRZTZDNnp6M1lqcEpmcGRB?=
 =?utf-8?Q?610INuunDD4vKMVWroRDcr9Co?=
X-OriginatorOrg: amd.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 9dce1869-c8b5-4b90-cfdb-08db52647720
X-MS-Exchange-CrossTenant-AuthSource: BN9PR12MB5115.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 11 May 2023 21:12:45.3423
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 4v0MHHCRAfd5MLX18S3M3wxPpBt1PCGWRyFEA+pA9KKnENSLs6+jheOdlow4O4/qzYGyZy2Y9AOZDPHezmLstg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4479
X-Spam-Status: No, score=-3.2 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FORGED_SPF_HELO,NICE_REPLY_A,
        RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_NONE,
        T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 2023-05-11 07:23, Daniil Dulov wrote:
> Pointer mqd_mem_obj can be deallocated in kfd_gtt_sa_allocate().
> The function then returns non-zero value, which causes the second deallocation.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Fixes: d1f8f0d17d40 ("drm/amdkfd: Move non-sdma mqd allocation out of init_mqd")
> Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>

Thanks. I am applying this patch to amd-staging-drm-next.

Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>


> ---
> v2: Move if (retval) inside previous if as Andi Shyti <andi.shyti@linux.intel.com> suggested.
>   drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c | 13 +++++++------
>   1 file changed, 7 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
> index 3b6f5963180d..dadeb2013fd9 100644
> --- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
> +++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
> @@ -113,18 +113,19 @@ static struct kfd_mem_obj *allocate_mqd(struct kfd_dev *kfd,
>   			&(mqd_mem_obj->gtt_mem),
>   			&(mqd_mem_obj->gpu_addr),
>   			(void *)&(mqd_mem_obj->cpu_ptr), true);
> +
> +		if (retval) {
> +			kfree(mqd_mem_obj);
> +			return NULL;
> +		}
>   	} else {
>   		retval = kfd_gtt_sa_allocate(kfd, sizeof(struct v9_mqd),
>   				&mqd_mem_obj);
> -	}
> -
> -	if (retval) {
> -		kfree(mqd_mem_obj);
> -		return NULL;
> +		if (retval)
> +			return NULL;
>   	}
>   
>   	return mqd_mem_obj;
> -
>   }
>   
>   static void init_mqd(struct mqd_manager *mm, void **mqd,