Commit 062ea905 authored by Mario Limonciello's avatar Mario Limonciello Committed by Alex Deucher
Browse files

drm/amd: Fix NULL pointer dereference in device cleanup 



When GPU initialization fails due to an unsupported HW block
IP blocks may have a NULL version pointer. During cleanup in
amdgpu_device_fini_hw, the code calls amdgpu_device_set_pg_state and
amdgpu_device_set_cg_state which iterate over all IP blocks and access
adev->ip_blocks[i].version without NULL checks, leading to a kernel
NULL pointer dereference.

Add NULL checks for adev->ip_blocks[i].version in both
amdgpu_device_set_cg_state and amdgpu_device_set_pg_state to prevent
dereferencing NULL pointers during GPU teardown when initialization has
failed.

Fixes: 39fc2bc4 ("drm/amdgpu: Protect GPU register accesses in powergated state in some paths")
Reviewed-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Signed-off-by: default avatarMario Limonciello <mario.limonciello@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
(cherry picked from commit b7ac7746)
Cc: stable@vger.kernel.org
parent 9d4837a2

drivers/gpu/drm/amd/amdgpu/amdgpu_device.c

+4 −0
Original line number Diff line number Diff line
@@ -3247,6 +3247,8 @@ int amdgpu_device_set_cg_state(struct amdgpu_device *adev, 
		i = state == AMD_CG_STATE_GATE ? j : adev->num_ip_blocks - j - 1;

		if (!adev->ip_blocks[i].status.late_initialized)

			continue;

		if (!adev->ip_blocks[i].version)

			continue;

		/* skip CG for GFX, SDMA on S0ix */

		if (adev->in_s0ix &&

		    (adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_GFX ||
@@ -3286,6 +3288,8 @@ int amdgpu_device_set_pg_state(struct amdgpu_device *adev, 
		i = state == AMD_PG_STATE_GATE ? j : adev->num_ip_blocks - j - 1;

		if (!adev->ip_blocks[i].status.late_initialized)

			continue;

		if (!adev->ip_blocks[i].version)

			continue;

		/* skip PG for GFX, SDMA on S0ix */

		if (adev->in_s0ix &&

		    (adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_GFX ||