ACK: [SRU][R][PATCH 1/1] drm/amdkfd: fix kernel crash on releasing NULL sysfs entry

[Ivan Hu]

Acked-by: Ivan Hu <ivan.hu at canonical.com>

On Mon, Sep 28, 2026 at 1:25 PM Woongjun Choi <oongjoon10 at gmail.com> wrote:

> From: Eric Huang <jinhuieric.huang at amd.com>
>
> BugLink: https://bugs.launchpad.net/bugs/2168705
>
> there is an abnormal case that When a process re-opens kfd
> with different mm_struct(execve() called by user), the
> allocated p->kobj will be freed, but missed setting it to NULL,
> that will cause sysfs/kernel crash with NULL pointers in p->kobj
> on kfd_process_remove_sysfs() when releasing process, and the
> similar error on kfd_procfs_del_queue() as well.
>
> Signed-off-by: Eric Huang <jinhuieric.huang at amd.com>
> Reviewed-by: Kent Russell <kent.russell at amd.com>
> Signed-off-by: Alex Deucher <alexander.deucher at amd.com>
> (cherry picked from commit 4ea64d482fc2cc85009fce5abdf4780ece00c31c)
> Signed-off-by: Woongjun Choi <oongjoon10 at gmail.com>
> ---
>  drivers/gpu/drm/amd/amdkfd/kfd_process.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c
> b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
> index fcda5ef..4b2fa74 100644
> --- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c
> +++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
> @@ -679,7 +679,7 @@ static void kfd_procfs_add_sysfs_files(struct
> kfd_process *p)
>
>  void kfd_procfs_del_queue(struct queue *q)
>  {
> -       if (!q)
> +       if (!q || !q->process->kobj)
>                 return;
>
>         kobject_del(&q->kobj);
> @@ -858,6 +858,7 @@ int kfd_create_process_sysfs(struct kfd_process
> *process)
>         if (ret) {
>                 pr_warn("Creating procfs pid directory failed");
>                 kobject_put(process->kobj);
> +               process->kobj = NULL;
>                 return ret;
>         }
>
> --
> 2.53.0
>
>
> --
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20261002/93361bb1/attachment-0001.html>