[PATCH 1/2] drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios()

[Lazar, Lijo]

[AMD Official Use Only - General]

When only second GPU has valid ATRM handle -
then it stays inside the loop and in the next call to pci_get_class(), it passes pdev reference to first GPU as the "from" param. That time it drops the reference count of "from" device.

Thanks,
Lijo
________________________________
From: Alex Deucher <alexdeucher at gmail.com>
Sent: Tuesday, November 22, 2022 9:55:33 PM
To: Lazar, Lijo <Lijo.Lazar at amd.com>
Cc: Xiongfeng Wang <wangxiongfeng2 at huawei.com>; Deucher, Alexander <Alexander.Deucher at amd.com>; Koenig, Christian <Christian.Koenig at amd.com>; Pan, Xinhui <Xinhui.Pan at amd.com>; airlied at gmail.com <airlied at gmail.com>; daniel at ffwll.ch <daniel at ffwll.ch>; Zhang, Hawking <Hawking.Zhang at amd.com>; dri-devel at lists.freedesktop.org <dri-devel at lists.freedesktop.org>; amd-gfx at lists.freedesktop.org <amd-gfx at lists.freedesktop.org>; yangyingliang at huawei.com <yangyingliang at huawei.com>
Subject: Re: [PATCH 1/2] drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios()

On Tue, Nov 22, 2022 at 9:59 AM Lazar, Lijo <lijo.lazar at amd.com> wrote:
>
>
>
> On 11/22/2022 8:19 PM, Alex Deucher wrote:
> > On Tue, Nov 22, 2022 at 6:12 AM Xiongfeng Wang
> > <wangxiongfeng2 at huawei.com> wrote:
> >>
> >> As comment of pci_get_class() says, it returns a pci_device with its
> >> refcount increased and decreased the refcount for the input parameter
> >> @from if it is not NULL.
> >>
> >> If we break the loop in radeon_atrm_get_bios() with 'pdev' not NULL, we
> >> need to call pci_dev_put() to decrease the refcount. Add the missing
> >> pci_dev_put() to avoid refcount leak.
> >
> > For both patches, I think pci_dev_put() needs to go into the loops.
> > There are 2 or more GPUs on the systems where this is relevant.
> >
>
> As per the logic, the loop breaks when it finds a valid ATRM handle. So
> dev_put is required only for that device.

Sure, but what if the handle is on the second DISPLAY_VGA or
DISPLAY_OTHER class PCI device on the system?  We've already called
pci_get_class() for the first PCI device that matched.

Alex

>
> When inside the loop this happens -  "decreased the refcount for the
> input parameter @from if it is not NULL"
>
> Thanks,
> Lijo
>
> > Alex
> >
> >>
> >> Fixes: d8ade3526b2a ("drm/radeon: handle non-VGA class pci devices with ATRM")
> >> Fixes: c61e2775873f ("drm/radeon: split ATRM support out from the ATPX handler (v3)")
> >> Signed-off-by: Xiongfeng Wang <wangxiongfeng2 at huawei.com>
> >> ---
> >>   drivers/gpu/drm/radeon/radeon_bios.c | 1 +
> >>   1 file changed, 1 insertion(+)
> >>
> >> diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
> >> index 33121655d50b..2df6ce3e32cb 100644
> >> --- a/drivers/gpu/drm/radeon/radeon_bios.c
> >> +++ b/drivers/gpu/drm/radeon/radeon_bios.c
> >> @@ -227,6 +227,7 @@ static bool radeon_atrm_get_bios(struct radeon_device *rdev)
> >>
> >>          if (!found)
> >>                  return false;
> >> +       pci_dev_put(pdev);
> >>
> >>          rdev->bios = kmalloc(size, GFP_KERNEL);
> >>          if (!rdev->bios) {
> >> --
> >> 2.20.1
> >>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: winmail.dat
Type: application/ms-tnef
Size: 20423 bytes
Desc: not available
URL: <https://lists.freedesktop.org/archives/dri-devel/attachments/20221122/1498245a/attachment-0001.bin>