[SRU] [R] [PATCH 13/13] drm/amdgpu: don't free standalone ip_discovery sysfs in sysfs_fini

[Yo-Jung Leo Lin (AMD)]

From: Mario Limonciello <mario.limonciello at amd.com>

BugLink: https://bugs.launchpad.net/bugs/2158690

The standalone_mode ip_discovery sysfs hierarchy is tied to the PCI
device lifetime and tracked in early_ip_discovery_list. It is torn down
only by amdgpu_discovery_sysfs_early_fini() on driver unbind, which is
why amdgpu_discovery_fini() already guards its teardown with
!standalone_mode.

Commit 7de02fe95312 ("drm/amdgpu: clean up discovery and preempt sysfs
entries on shutdown") added an unconditional amdgpu_discovery_sysfs_fini()
call in amdgpu_device_sys_interface_fini(), which runs during
amdgpu_device_fini_hw() on every unbind/reload. On reload this freed the
PCI-device-owned ip_top via kobject_put()->ip_disc_release()->kfree(),
leaving a dangling pointer in early_ip_discovery_list. The subsequent
amdgpu_discovery_sysfs_early_fini() then dereferenced and put the freed
object, causing a use-after-free and double-free, and prematurely
destroyed the sysfs that was meant to persist across reloads.

Make amdgpu_discovery_sysfs_fini() skip standalone_mode objects so the
invariant is centralized at the teardown site and the new call site
cannot free the PCI-device-owned ip_top. Teardown of standalone sysfs
remains the sole responsibility of amdgpu_discovery_sysfs_early_fini().

Fixes: 7de02fe95312 ("drm/amdgpu: clean up discovery and preempt sysfs entries on shutdown")
Acked-by: Alex Deucher <alexander.deucher at amd.com>
Signed-off-by: Mario Limonciello <mario.limonciello at amd.com>
Signed-off-by: Alex Deucher <alexander.deucher at amd.com>
(cherry picked from commit 26373c71945544bceed6e08eede8100c97be74fa linux-next)
Signed-off-by: Yo-Jung Leo Lin (AMD) <Leo.Lin at amd.com>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
index 148e807b64f8..59b3fd775ea1 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
@@ -1476,6 +1476,15 @@ void amdgpu_discovery_sysfs_fini(struct amdgpu_device *adev)
 	if (!ip_top)
 		return;
 
+	/*
+	 * In standalone mode the sysfs hierarchy is tied to the PCI device
+	 * lifetime and is torn down by amdgpu_discovery_sysfs_early_fini().
+	 * Freeing it here would leave a dangling pointer in the early
+	 * discovery list, causing a use-after-free on driver unbind.
+	 */
+	if (ip_top->standalone_mode)
+		return;
+
 	adev->discovery.ip_top = NULL;
 	die_kset = &ip_top->die_kset;
 	spin_lock(&die_kset->list_lock);
-- 
2.43.0