[5.12,251/384] drm/amdgpu: fix NULL pointer dereference

Message ID	20210510102023.158865963@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Guchun Chen <guchun.chen@amd.com>, =?utf-8?q?Christian_K=C3=B6nig?= <christian.koenig@amd.com>, Alex Deucher <alexander.deucher@amd.com>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.12 251/384] drm/amdgpu: fix NULL pointer dereference Date: Mon, 10 May 2021 12:20:40 +0200 Message-Id: <20210510102023.158865963@linuxfoundation.org> In-Reply-To: <20210510102014.849075526@linuxfoundation.org> References: <20210510102014.849075526@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.12,003/384] bus: mhi: core: Sanity check values from remote device before use [5.12,004/384] bus: mhi: core: Add missing checks for MMIO register entries [5.12,005/384] bus: mhi: pci_generic: Remove WQ_MEM_RECLAIM flag from state workqueue [5.12,006/384] bus: mhi: core: Fix MHI runtime_pm behavior [5.12,007/384] bus: mhi: core: Fix invalid error returning in mhi_queue [5.12,010/384] s390/disassembler: increase ebpf disasm buffer size [5.12,012/384] s390/vfio-ap: fix circular lockdep when setting/clearing crypto masks [5.12,014/384] vhost-vdpa: fix vm_flags for virtqueue doorbell mapping [5.12,017/384] ACPI: custom_method: fix a possible memory leak [5.12,018/384] ftrace: Handle commands when closing set_ftrace_filter file [5.12,019/384] ARM: 9056/1: decompressor: fix BSS size calculation for LLVM ld.lld [5.12,023/384] fs/epoll: restore waking from ep_done_scan() [5.12,024/384] reset: add missing empty function reset_control_rearm() [5.12,025/384] mtd: spi-nor: core: Fix an issue of releasing resources during read/write [5.12,028/384] mtd: rawnand: atmel: Update ecc_stats.corrected counter [5.12,030/384] erofs: add unsupported inode i_format check [5.12,031/384] spi: stm32-qspi: fix pm_runtime usage_count counter [5.12,036/384] scsi: lpfc: Fix rmmod crash due to bad ring pointers to abort_iotag [5.12,037/384] scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand() [5.12,039/384] scsi: mpt3sas: Block PCI config access from userspace during reset [5.12,040/384] mmc: uniphier-sd: Fix an error handling path in uniphier_sd_probe() [5.12,041/384] mmc: uniphier-sd: Fix a resource leak in the remove function [5.12,042/384] mmc: sdhci: Check for reset prior to DMA address unmap [5.12,044/384] mmc: sdhci-tegra: Add required callbacks to set/clear CQE_EN bit [5.12,045/384] mmc: block: Update ext_csd.cache_ctrl if it was written [5.12,047/384] mmc: core: Do a power cycle when the CMD11 fails [5.12,048/384] mmc: core: Set read only for SD cards with permanent write protect bit [5.12,049/384] mmc: core: Fix hanging on I/O during system suspend for removable cards [5.12,053/384] cifs: fix leak in cifs_smb3_do_mount() ctx [5.12,055/384] cifs: fix regression when mounting shares with prefix paths [5.12,057/384] btrfs: handle remount to no compress during compression [5.12,062/384] btrfs: zoned: fix unpaired block group unfreeze during device replace [5.12,064/384] posix-timers: Preserve return value in clock_adjtime32() [5.12,065/384] fbdev: zero-fill colormap in fbcmap.c [5.12,068/384] staging: wimax/i2400m: fix byte-order issue [5.12,071/384] bus: mhi: pci_generic: No-Op for device_wake operations [5.12,072/384] bus: mhi: core: Destroy SBL devices when moving to mission mode [5.12,073/384] bus: mhi: core: Process execution environment changes serially [5.12,075/384] crypto: qat - fix unmap invalid dma address [5.12,076/384] usb: gadget: uvc: add bInterval checking for HS mode [5.12,079/384] crypto: hisilicon/sec - fixes a printing error [5.12,080/384] genirq/matrix: Prevent allocation counter corruption [5.12,082/384] usb: gadget: f_uac1: validate input parameters [5.12,084/384] usb: xhci: Fix port minor revision [5.12,085/384] kselftest/arm64: mte: Fix compilation with native compiler [5.12,090/384] ARM: dts: ux500: Fix up TVK R3 sensors [5.12,092/384] x86/boot: Add $(CLANG_FLAGS) to compressed KBUILD_CFLAGS [5.12,093/384] efi/libstub: Add $(CLANG_FLAGS) to x86 flags [5.12,096/384] tee: optee: do not check memref size on return from Secure World [5.12,097/384] soundwire: cadence: only prepare attached devices on clock stop [5.12,098/384] perf/arm_pmu_platform: Use dev_err_probe() for IRQ errors [5.12,099/384] perf/arm_pmu_platform: Fix error handling [5.12,100/384] random: initialize ChaCha20 constants with correct endianness [5.12,101/384] usb: xhci-mtk: support quirk to disable usb2 lpm [5.12,103/384] xhci: check port array allocation was successful before dereferencing it [5.12,104/384] xhci: check control context is valid before dereferencing it. [5.12,106/384] xhci: prevent double-fetch of transfer and transfer event TRBs [5.12,108/384] bus: mhi: pci_generic: Implement PCI shutdown callback [5.12,114/384] spi: dln2: Fix reference leak to master [5.12,118/384] usb: gadget: tegra-xudc: Fix possible use-after-free in tegra_xudc_remove() [5.12,120/384] usb: core: hub: Fix PM reference leak in usb_port_resume() [5.12,121/384] usb: dwc3: gadget: Check for disabled LPM quirk [5.12,124/384] phy: phy-twl4030-usb: Fix possible use-after-free in twl4030_usb_remove() [5.12,125/384] crypto: sun4i-ss - Fix PM reference leak when pm_runtime_get_sync() fails [5.12,126/384] crypto: sun8i-ss - Fix PM reference leak when pm_runtime_get_sync() fails [5.12,127/384] crypto: sun8i-ce - Fix PM reference leak in sun8i_ce_probe() [5.12,128/384] crypto: stm32/hash - Fix PM reference leak on stm32-hash.c [5.12,130/384] crypto: sa2ul - Fix PM reference leak in sa_ul_probe() [5.12,132/384] platform/x86: intel_pmc_core: Dont use global pmcdev in quirks [5.12,134/384] btrfs: use btrfs_inode_lock/btrfs_inode_unlock inode lock helpers [5.12,135/384] btrfs: fix race between marking inode needs to be logged and log syncing [5.12,138/384] btrfs: do proper error handling in btrfs_update_reloc_root [5.12,141/384] drm: Added orientation quirk for OneGX1 Pro [5.12,142/384] drm/qxl: do not run release if qxl failed to init [5.12,144/384] drm/ast: Fix invalid usage of AST_MAX_HWC_WIDTH in cursor atomic_check [5.12,147/384] drm/amd/pm: do not issue message while write "r" into pp_od_clk_voltage [5.12,148/384] drm/ast: fix memory leak when unload the driver [5.12,150/384] drm/amd/display: Dont optimize bandwidth before disabling planes [5.12,151/384] drm/amd/display: Return invalid state if GPINT times out [5.12,153/384] drm/amd/display/dc/dce/dce_aux: Remove duplicate line causing field overwritten issue [5.12,154/384] scsi: lpfc: Fix incorrect dbde assignment when building target abts wqe [5.12,156/384] scsi: lpfc: Fix status returned in lpfc_els_retry() error exit path [5.12,157/384] scsi: lpfc: Fix PLOGI ACC to be transmit after REG_LOGIN [5.12,159/384] drm/amd/pm/swsmu: clean up user profile function [5.12,161/384] sched/fair: Fix task utilization accountability in compute_energy() [5.12,164/384] kvfree_rcu: Use same set of GFP flags as does single-argument [5.12,165/384] drm/virtio: fix possible leak/unlock virtio_gpu_object_array [5.12,167/384] media: ite-cir: check for receive overflow [5.12,169/384] media: drivers/media/usb: fix memory leak in zr364xx_probe [5.12,171/384] media: imx: capture: Return -EPIPE from __capture_legacy_try_fmt() [5.12,172/384] atomisp: dont let it go past pipes array [5.12,174/384] extcon: arizona: Fix some issues when HPDET IRQ fires after the jack has been unpl... [5.12,175/384] extcon: arizona: Fix various races on driver unbind [5.12,176/384] media: venus: core, venc, vdec: Fix probe dependency error [5.12,178/384] media: media/saa7164: fix saa7164_encoder_register() memory leak bugs [5.12,180/384] media: v4l2-ctrls.c: initialize flags field of p_fwht_params [5.12,181/384] power: supply: Use IRQF_ONESHOT [5.12,184/384] drm/amdgpu: enable retry fault wptr overflow [5.12,188/384] drm/amd/display: Align cursor cache address to 2KB [5.12,189/384] drm/amdgpu : Fix asic reset regression issue introduce by 8f211fe8ac7c4f [5.12,191/384] drm/amd/display: Fix UBSAN warning for not a valid value for type _Bool [5.12,192/384] drm/amd/display: DCHUB underflow counter increasing in some scenarios [5.12,193/384] drm/amd/display: fix dml prefetch validation [5.12,195/384] drm/amdgpu: Fix memory leak [5.12,196/384] scsi: qla2xxx: Always check the return value of qla24xx_get_isp_stats() [5.12,197/384] drm/vkms: fix misuse of WARN_ON [5.12,198/384] block, bfq: fix weight-raising resume with !low_latency [5.12,199/384] scsi: qla2xxx: Fix use after free in bsg [5.12,200/384] mmc: sdhci-esdhc-imx: validate pinctrl before use it [5.12,202/384] mmc: sdhci-brcmstb: Remove CQE quirk [5.12,203/384] ata: ahci: Disable SXS for Hisilicon Kunpeng920 [5.12,208/384] selftests/resctrl: Fix compilation issues for other global variables [5.12,210/384] selftests/resctrl: Fix missing options "-n" and "-p" [5.12,211/384] selftests/resctrl: Use resctrl/info for feature detection [5.12,213/384] selftests/resctrl: Fix checking for < 0 for unsigned values [5.12,215/384] power: supply: cpcap-charger: Add usleep to cpcap charger to avoid usb plug bounce [5.12,219/384] scsi: scsi_dh_alua: Remove check for ASC 24h in alua_rtpg() [5.12,222/384] media: uvcvideo: Fix XU id print in forward scan [5.12,223/384] media: uvcvideo: Support devices that report an OT as an entity source [5.12,226/384] clk: socfpga: arria10: Fix memory leak of socfpga_clk on error return [5.12,228/384] power: supply: s3c_adc_battery: fix possible use-after-free in s3c_adc_bat_remove() [5.12,231/384] media: i2c: adv7511-v4l2: fix possible use-after-free in adv7511_remove() [5.12,232/384] media: i2c: tda1997: Fix possible use-after-free in tda1997x_remove() [5.12,235/384] media: sun8i-di: Fix runtime PM imbalance in deinterlace_start_streaming [5.12,236/384] media: dvb-usb: fix memory leak in dvb_usb_adapter_init [5.12,243/384] drm/radeon/ttm: Fix memory leak userptr pages [5.12,246/384] drm/radeon: dont evict if not initialized [5.12,248/384] amdgpu: avoid incorrect %hu format string [5.12,250/384] drm/amd/display: Try YCbCr420 color when YCbCr444 fails [5.12,251/384] drm/amdgpu: fix NULL pointer dereference [5.12,252/384] drm/amd/display: Update DCN302 SR Exit Latency [5.12,253/384] scsi: mpt3sas: Fix out-of-bounds warnings in _ctl_addnl_diag_query [5.12,256/384] scsi: lpfc: Fix error handling for mailboxes completed in MBX_POLL mode [5.12,257/384] scsi: lpfc: Remove unsupported mbox PORT_CAPABILITIES logic [5.12,258/384] mfd: intel-m10-bmc: Fix the register access range [5.12,260/384] mfd: arizona: Fix rumtime PM imbalance on error [5.12,261/384] scsi: libfc: Fix a format specifier [5.12,262/384] perf: Rework perf_event_exit_event() [5.12,263/384] sched,fair: Alternative sched_slice() [5.12,265/384] block/rnbd-clt: Fix missing a memory free when unloading the module [5.12,266/384] io_uring: safer sq_creds putting [5.12,267/384] s390/archrandom: add parameter check for s390_arch_random_generate [5.12,269/384] nvmet: avoid queuing keep-alive timer if it is disabled [5.12,272/384] ALSA: hda/conexant: Re-order CX5066 quirk table entries [5.12,273/384] ALSA: sb: Fix two use after free in snd_sb_qsound_build [5.12,275/384] ALSA: usb-audio: Add dB range mapping for Sennheiser Communications Headset PC 8 [5.12,276/384] ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 445 G7 [5.12,280/384] ALSA: hda/realtek: fix static noise on ALC285 Lenovo laptops [5.12,282/384] tools/power/turbostat: Fix turbostat for AMD Zen CPUs [5.12,284/384] btrfs: fix a potential hole punching failure [5.12,287/384] riscv/kprobe: fix kernel panic when invoking sys_read traced by kprobe [5.12,288/384] fs: fix reporting supported extra file attributes for statx() [5.12,289/384] virtiofs: fix memory leak in virtio_fs_probe() [5.12,292/384] f2fs: fix error handling in f2fs_end_enable_verity() [5.12,296/384] net/sched: sch_frag: fix stack OOB read while fragmenting IPv4 packets [5.12,298/384] NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds [5.12,302/384] jffs2: Fix kasan slab-out-of-bounds problem [5.12,303/384] jffs2: Hook up splice_write callback [5.12,304/384] iommu/vt-d: Force to flush iotlb before creating superpage [5.12,305/384] powerpc/vdso: Separate vvar vma from vdso [5.12,306/384] powerpc/powernv: Enable HAIL (HV AIL) for ISA v3.1 processors [5.12,307/384] powerpc/eeh: Fix EEH handling for hugepages in ioremap space. [5.12,310/384] powerpc: fix EDEADLOCK redefinition error in uapi/asm/errno.h [5.12,312/384] powerpc/kvm: Fix build error when PPC_MEM_KEYS/PPC_PSERIES=n [5.12,317/384] crypto: rng - fix crypto_rng_reset() refcounting when !CRYPTO_STATS [5.12,318/384] md/raid1: properly indicate failure when ending a failed write request [5.12,320/384] fuse: fix write deadlock [5.12,321/384] mm: page_alloc: ignore init_on_free=1 for debug_pagealloc=1 [5.12,324/384] sfc: farch: fix TX queue lookup in TX event handling [5.12,325/384] sfc: adjust efx->xdp_tx_queue_count with the real number of initialized queues [5.12,326/384] rcu/nocb: Fix missed nocb_timer requeue [5.12,327/384] security: commoncap: fix -Wstringop-overread warning [5.12,328/384] Fix misc new gcc warnings [5.12,332/384] Revert 337f13046ff0 ("futex: Allow FUTEX_CLOCK_REALTIME with FUTEX_WAIT op") [5.12,334/384] x86/cpu: Initialize MSR_TSC_AUX if RDTSCP or RDPID is supported [5.12,335/384] kbuild: update config_data.gz only when the content of .config is changed [5.12,339/384] ext4: do not set SB_ACTIVE in ext4_orphan_cleanup() [5.12,340/384] ext4: always panic when errors=panic is specified [5.12,342/384] ext4: fix ext4_error_err save negative errno into superblock [5.12,343/384] ext4: fix error return code in ext4_fc_perform_commit() [5.12,345/384] ext4: Fix occasional generic/418 failure [5.12,348/384] media: dvb-usb: Fix memory leak at error in dvb_usb_device_init() [5.12,349/384] media: staging/intel-ipu3: Fix memory leak in imu_fmt [5.12,352/384] media: v4l2-ctrls: fix reference to freed memory [5.12,353/384] media: coda: fix macroblocks count control usage [5.12,354/384] media: venus: pm_helpers: Set opp clock name for v1 [5.12,355/384] media: venus: venc_ctrls: Change default header mode [5.12,356/384] media: venus: hfi_cmds: Support plane-actual-info property from v1 [5.12,357/384] media: venus: hfi_parser: Dont initialize parser on v1 [5.12,358/384] media: venus: hfi_parser: Check for instance after hfi platform get [5.12,359/384] io_uring: remove extra sqpoll submission halting [5.12,360/384] io_uring: fix shared sqpoll cancellation hangs [5.12,364/384] usb: gadget: Fix double free of device descriptor pointers [5.12,365/384] usb: gadget/function/f_fs string table fix for multiple languages [5.12,366/384] usb: dwc3: gadget: Remove FS bInterval_m1 limitation [5.12,368/384] usb: dwc3: core: Do core softreset when switch mode [5.12,370/384] PCI: dwc: Move iATU detection earlier [5.12,371/384] tty: fix memory leak in vc_deallocate [5.12,373/384] tools/power turbostat: Fix offset overflow issue in index converting [5.12,378/384] dm integrity: fix missing goto in bitmap_flush_interval error handling [5.12,380/384] pinctrl: Ingenic: Add missing pins to the JZ4770 MAC MII group. [5.12,381/384] pinctrl: Ingenic: Add support for read the pin configuration of X1830. [5.12,382/384] lib/vsprintf.c: remove leftover f and F cases from bstr_printf() [5.12,384/384] thermal/core/fair share: Lock the thermal zone while looping over instances

Message ID

20210510102023.158865963@linuxfoundation.org

State

Superseded

Headers

From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org,
	Guchun Chen <guchun.chen@amd.com>, =?utf-8?q?Christian_K=C3=B6nig?=
	<christian.koenig@amd.com>, Alex Deucher <alexander.deucher@amd.com>,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.12 251/384] drm/amdgpu: fix NULL pointer dereference
Date: Mon, 10 May 2021 12:20:40 +0200
Message-Id: <20210510102023.158865963@linuxfoundation.org>
In-Reply-To: <20210510102014.849075526@linuxfoundation.org>
References: <20210510102014.849075526@linuxfoundation.org>
User-Agent: quilt/0.66
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Precedence: bulk

Series

None | expand

Commit Message

Greg KH May 10, 2021, 10:20 a.m. UTC

From: Guchun Chen <guchun.chen@amd.com>

[ Upstream commit 3c3dc654333f6389803cdcaf03912e94173ae510 ]

ttm->sg needs to be checked before accessing its child member.

Call Trace:
 amdgpu_ttm_backend_destroy+0x12/0x70 [amdgpu]
 ttm_bo_cleanup_memtype_use+0x3a/0x60 [ttm]
 ttm_bo_release+0x17d/0x300 [ttm]
 amdgpu_bo_unref+0x1a/0x30 [amdgpu]
 amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x78b/0x8b0 [amdgpu]
 kfd_ioctl_alloc_memory_of_gpu+0x118/0x220 [amdgpu]
 kfd_ioctl+0x222/0x400 [amdgpu]
 ? kfd_dev_is_large_bar+0x90/0x90 [amdgpu]
 __x64_sys_ioctl+0x8e/0xd0
 ? __context_tracking_exit+0x52/0x90
 do_syscall_64+0x33/0x80
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f97f264d317
Code: b3 66 90 48 8b 05 71 4b 2d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 41 4b 2d 00 f7 d8 64 89 01 48
RSP: 002b:00007ffdb402c338 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f97f3cc63a0 RCX: 00007f97f264d317
RDX: 00007ffdb402c380 RSI: 00000000c0284b16 RDI: 0000000000000003
RBP: 00007ffdb402c380 R08: 00007ffdb402c428 R09: 00000000c4000004
R10: 00000000c4000004 R11: 0000000000000246 R12: 00000000c0284b16
R13: 0000000000000003 R14: 00007f97f3cc63a0 R15: 00007f8836200000

Signed-off-by: Guchun Chen <guchun.chen@amd.com>
Acked-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
index f61fd2cf3fee..383c178cf074 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
@@ -942,7 +942,7 @@  static void amdgpu_ttm_tt_unpin_userptr(struct ttm_bo_device *bdev,
 		DMA_BIDIRECTIONAL : DMA_TO_DEVICE;
 
 	/* double check that we don't free the table twice */
-	if (!ttm->sg->sgl)
+	if (!ttm->sg || !ttm->sg->sgl)
 		return;
 
 	/* unmap the pages mapped to the device */

[5.12,251/384] drm/amdgpu: fix NULL pointer dereference

Commit Message

Patch