[PATCH 1/2] drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios()

[Alex Deucher]

On Tue, Nov 22, 2022 at 12:10 PM Lazar, Lijo <Lijo.Lazar at amd.com> wrote:
>
> [AMD Official Use Only - General]
>
> When only second GPU has valid ATRM handle -
> then it stays inside the loop and in the next call to pci_get_class(), it passes pdev reference to first GPU as the "from" param. That time it drops the reference count of "from" device.

ah, right, that was the part I missed.  Thanks.

Alex


>
> Thanks,
> Lijo
> ________________________________
> From: Alex Deucher <alexdeucher at gmail.com>
> Sent: Tuesday, November 22, 2022 9:55:33 PM
> To: Lazar, Lijo <Lijo.Lazar at amd.com>
> Cc: Xiongfeng Wang <wangxiongfeng2 at huawei.com>; Deucher, Alexander <Alexander.Deucher at amd.com>; Koenig, Christian <Christian.Koenig at amd.com>; Pan, Xinhui <Xinhui.Pan at amd.com>; airlied at gmail.com <airlied at gmail.com>; daniel at ffwll.ch <daniel at ffwll.ch>; Zhang, Hawking <Hawking.Zhang at amd.com>; dri-devel at lists.freedesktop.org <dri-devel at lists.freedesktop.org>; amd-gfx at lists.freedesktop.org <amd-gfx at lists.freedesktop.org>; yangyingliang at huawei.com <yangyingliang at huawei.com>
> Subject: Re: [PATCH 1/2] drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios()
>
> On Tue, Nov 22, 2022 at 9:59 AM Lazar, Lijo <lijo.lazar at amd.com> wrote:
> >
> >
> >
> > On 11/22/2022 8:19 PM, Alex Deucher wrote:
> > > On Tue, Nov 22, 2022 at 6:12 AM Xiongfeng Wang
> > > <wangxiongfeng2 at huawei.com> wrote:
> > >>
> > >> As comment of pci_get_class() says, it returns a pci_device with its
> > >> refcount increased and decreased the refcount for the input parameter
> > >> @from if it is not NULL.
> > >>
> > >> If we break the loop in radeon_atrm_get_bios() with 'pdev' not NULL, we
> > >> need to call pci_dev_put() to decrease the refcount. Add the missing
> > >> pci_dev_put() to avoid refcount leak.
> > >
> > > For both patches, I think pci_dev_put() needs to go into the loops.
> > > There are 2 or more GPUs on the systems where this is relevant.
> > >
> >
> > As per the logic, the loop breaks when it finds a valid ATRM handle. So
> > dev_put is required only for that device.
>
> Sure, but what if the handle is on the second DISPLAY_VGA or
> DISPLAY_OTHER class PCI device on the system?  We've already called
> pci_get_class() for the first PCI device that matched.
>
> Alex
>
> >
> > When inside the loop this happens -  "decreased the refcount for the
> > input parameter @from if it is not NULL"
> >
> > Thanks,
> > Lijo
> >
> > > Alex
> > >
> > >>
> > >> Fixes: d8ade3526b2a ("drm/radeon: handle non-VGA class pci devices with ATRM")
> > >> Fixes: c61e2775873f ("drm/radeon: split ATRM support out from the ATPX handler (v3)")
> > >> Signed-off-by: Xiongfeng Wang <wangxiongfeng2 at huawei.com>
> > >> ---
> > >>   drivers/gpu/drm/radeon/radeon_bios.c | 1 +
> > >>   1 file changed, 1 insertion(+)
> > >>
> > >> diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
> > >> index 33121655d50b..2df6ce3e32cb 100644
> > >> --- a/drivers/gpu/drm/radeon/radeon_bios.c
> > >> +++ b/drivers/gpu/drm/radeon/radeon_bios.c
> > >> @@ -227,6 +227,7 @@ static bool radeon_atrm_get_bios(struct radeon_device *rdev)
> > >>
> > >>          if (!found)
> > >>                  return false;
> > >> +       pci_dev_put(pdev);
> > >>
> > >>          rdev->bios = kmalloc(size, GFP_KERNEL);
> > >>          if (!rdev->bios) {
> > >> --
> > >> 2.20.1
> > >>