linux-kernel - Re: [PATCH] drm/amdkfd: Fix potential NULL pointer dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c55e9866-83f6-a3a0-2ad3-40090e978b40@amd.com>
Date:   Tue, 5 Apr 2022 13:00:42 -0400
From:   Felix Kuehling <felix.kuehling@....com>
To:     Grigory Vasilyev <h0tc0d3@...il.com>,
        Rodrigo Siqueira <Rodrigo.Siqueira@....com>,
        Melissa Wen <mwen@...lia.com>
Cc:     "Pan, Xinhui" <Xinhui.Pan@....com>, linux-kernel@...r.kernel.org,
        amd-gfx@...ts.freedesktop.org, David Airlie <airlied@...ux.ie>,
        dri-devel@...ts.freedesktop.org,
        Alex Deucher <alexander.deucher@....com>,
        Christian König <christian.koenig@....com>
Subject: Re: [PATCH] drm/amdkfd: Fix potential NULL pointer dereference

Am 2022-04-04 um 18:21 schrieb Grigory Vasilyev:
> In the amdgpu_amdkfd_get_xgmi_bandwidth_mbytes function,
> the peer_adev pointer can be NULL and is passed to amdgpu_xgmi_get_num_links.
>
> In amdgpu_xgmi_get_num_links, peer_adev pointer is dereferenced
> without any checks: peer_adev->gmc.xgmi.node_id .

What's worse, peer_adev is uninitialized with an undefined value if src 
is NULL. So that code was definitely bogus.

However, I think your patch will result in incorrect results. Currently 
amdgpu_amdkfd_get_xgmi_bandwidth is always called with is_min=true if 
src==NULL, and with is_min=false if src!=NULL. The intention is, that we 
assume a single XGMI link in the case that src==NULL. That means the 
is_min parameter is redundant. What we should do instead is, assume that 
num_links==1 if src==NULL, and drop the is_min parameter.

That would keep things working the way they do now, and prevent 
potential problems in the future.

Regards,
   Felix


>
> Signed-off-by: Grigory Vasilyev <h0tc0d3@...il.com>
> ---
>   drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 5 ++---
>   1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
> index be1a55f8b8c5..1a1006b18016 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
> @@ -541,11 +541,10 @@ int amdgpu_amdkfd_get_xgmi_bandwidth_mbytes(struct amdgpu_device *dst,
>   	struct amdgpu_device *adev = dst, *peer_adev;
>   	int num_links;
>   
> -	if (adev->asic_type != CHIP_ALDEBARAN)
> +	if (!src || adev->asic_type != CHIP_ALDEBARAN)
>   		return 0;
>   
> -	if (src)
> -		peer_adev = src;
> +	peer_adev = src;
>   
>   	/* num links returns 0 for indirect peers since indirect route is unknown. */
>   	num_links = is_min ? 1 : amdgpu_xgmi_get_num_links(adev, peer_adev);