linux-kernel - Re: [PATCH] drm/amdgpu: Fix error handling in amdgpu_atpx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <5f614997-41a5-432f-ab3c-ea1011c16dc4@amd.com>
Date: Fri, 21 Nov 2025 12:23:12 +0530
From: "Lazar, Lijo" <lijo.lazar@....com>
To: Ma Ke <make24@...as.ac.cn>, alexander.deucher@....com,
 christian.koenig@....com, airlied@...il.com, simona@...ll.ch,
 evan.quan@....com
Cc: amd-gfx@...ts.freedesktop.org, dri-devel@...ts.freedesktop.org,
 linux-kernel@...r.kernel.org, akpm@...ux-foundation.org,
 stable@...r.kernel.org
Subject: Re: [PATCH] drm/amdgpu: Fix error handling in amdgpu_atpx_detect



On 11/21/2025 7:14 AM, Ma Ke wrote:
> amdgpu_atpx_detect() uses pci_get_class() in two while loops to
> iterate through VGA and OTHER display class PCI devices. Each call to
> pci_get_class() increments the reference count of the returned PCI
> device. However, after the loops complete, there are no corresponding
> pci_dev_put() to decrement these reference counts.
> 
> Add pci_dev_put() after each while loop to release reference counts
> held by the last devices found in each class.
> 
> Found by code review.

This doesn't look correct. Below is the documented API behaviour.

"Iterates through the list of known PCI devices. If a PCI device is 
found with a matching class, the reference count to the device is 
incremented and a pointer to its device structure is returned. 
Otherwise, NULL is returned. A new search is initiated by passing NULL 
as the from argument. Otherwise if from is not NULL, searches continue 
from next device on the global list. The reference count for from is 
always decremented if it is not NULL."


After a device is found, it goes in as the "from" device for the next 
iteration. Then reference count of the from device is decremented. Both 
the loops continue till pdev gets to NULL. So there is nothing to put() 
after the loops are completed.

Thanks,
Lijo

> 
> Cc: stable@...r.kernel.org
> Fixes: 5d30ed3c2c74 ("Revert "drm/amdgpu: simplify ATPX detection"")
> Signed-off-by: Ma Ke <make24@...as.ac.cn>
> ---
>   drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c | 5 +++++
>   1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
> index 3893e6fc2f03..9eb776a2e8bb 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
> @@ -617,6 +617,9 @@ static bool amdgpu_atpx_detect(void)
>   		amdgpu_atpx_get_quirks(pdev);
>   	}
>   
> +	pci_dev_put(pdev);
> +	pdev = NULL;
> +
>   	while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_OTHER << 8, pdev)) != NULL) {
>   		vga_count++;
>   
> @@ -627,6 +630,8 @@ static bool amdgpu_atpx_detect(void)
>   		amdgpu_atpx_get_quirks(pdev);
>   	}
>   
> +	pci_dev_put(pdev);
> +
>   	if (has_atpx && vga_count == 2) {
>   		acpi_get_name(amdgpu_atpx_priv.atpx.handle, ACPI_FULL_PATHNAME, &buffer);
>   		pr_info("vga_switcheroo: detected switching method %s handle\n",