github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-24 06:24:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

drm/amdgpu: don't free standalone ip_discovery sysfs in sysfs_fini

Browse Source 
The standalone_mode ip_discovery sysfs hierarchy is tied to the PCI
device lifetime and tracked in early_ip_discovery_list. It is torn down
only by amdgpu_discovery_sysfs_early_fini() on driver unbind, which is
why amdgpu_discovery_fini() already guards its teardown with
!standalone_mode.

Commit 7de02fe953 ("drm/amdgpu: clean up discovery and preempt sysfs
entries on shutdown") added an unconditional amdgpu_discovery_sysfs_fini()
call in amdgpu_device_sys_interface_fini(), which runs during
amdgpu_device_fini_hw() on every unbind/reload. On reload this freed the
PCI-device-owned ip_top via kobject_put()->ip_disc_release()->kfree(),
leaving a dangling pointer in early_ip_discovery_list. The subsequent
amdgpu_discovery_sysfs_early_fini() then dereferenced and put the freed
object, causing a use-after-free and double-free, and prematurely
destroyed the sysfs that was meant to persist across reloads.

Make amdgpu_discovery_sysfs_fini() skip standalone_mode objects so the
invariant is centralized at the teardown site and the new call site
cannot free the PCI-device-owned ip_top. Teardown of standalone sysfs
remains the sole responsibility of amdgpu_discovery_sysfs_early_fini().

Fixes: 7de02fe953 ("drm/amdgpu: clean up discovery and preempt sysfs entries on shutdown")
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
This commit is contained in:
Mario Limonciello 2026-06-22 09:19:14 -07:00 committed by Alex Deucher
parent cc80854eda
commit 26373c7194
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
View File

@ -1489,6 +1489,15 @@ void amdgpu_discovery_sysfs_fini(struct amdgpu_device *adev)
if (!ip_top)
return;
/*
* In standalone mode the sysfs hierarchy is tied to the PCI device
* lifetime and is torn down by amdgpu_discovery_sysfs_early_fini().
* Freeing it here would leave a dangling pointer in the early
* discovery list, causing a use-after-free on driver unbind.
*/
if (ip_top->standalone_mode)
return;
adev->discovery.ip_top = NULL;
die_kset = &ip_top->die_kset;
spin_lock(&die_kset->list_lock);