[PATCH] drm/amdgpu: Disable irq on device before destroying it

[Mikita Lipski]

On 2018-03-15 10:15 AM, Alex Deucher wrote:
> On Thu, Mar 15, 2018 at 10:10 AM,  <mikita.lipski at amd.com> wrote:
>> From: Mikita Lipski <mikita.lipski at amd.com>
>>
>> Disable irq on devices before destroying them. That prevents
>> use-after-free memory access when unloading the driver.
>>
>> Signed-off-by: Mikita Lipski <mikita.lipski at amd.com>
>> ---
>>   drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 5 +++--
>>   1 file changed, 3 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
>> index b4911911..593396f 100644
>> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
>> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
>> @@ -1456,6 +1456,9 @@ static int amdgpu_device_ip_fini(struct amdgpu_device *adev)
>>                  }
>>          }
>>
>> +       /* disable all interrupts */
>> +       amdgpu_irq_disable_all(adev);
>> +
> 
> Any reason not to move this to the top of this function before the SMC loop?
> 
> Alex

It can be done, but it does not seem to have any functional effect.
The use-after-free corruption is caused by disabling DCE's irq after 
destroying it.

Nik

> 
>>          for (i = adev->num_ip_blocks - 1; i >= 0; i--) {
>>                  if (!adev->ip_blocks[i].status.hw)
>>                          continue;
>> @@ -1482,8 +1485,6 @@ static int amdgpu_device_ip_fini(struct amdgpu_device *adev)
>>                  adev->ip_blocks[i].status.hw = false;
>>          }
>>
>> -       /* disable all interrupts */
>> -       amdgpu_irq_disable_all(adev);
>>
>>          for (i = adev->num_ip_blocks - 1; i >= 0; i--) {
>>                  if (!adev->ip_blocks[i].status.sw)
>> --
>> 2.7.4
>>
>> _______________________________________________
>> amd-gfx mailing list
>> amd-gfx at lists.freedesktop.org
>> https://lists.freedesktop.org/mailman/listinfo/amd-gfx