[SRU][R][PATCH 0/1] drm/amdkfd: fix kernel crash on releasing NULL sysfs entry

[Woongjun Choi]

BugLink: https://bugs.launchpad.net/bugs/2168705

SRU Justification:

[Impact]

On Ubuntu 26.04 Resolute 7.0 kernels, AMD KFD can crash the
kernel when a process re-opens /dev/kfd with a different mm_struct
after execve(), while the previous kfd_process for the same PID has
not yet been released.

kfd_create_process_sysfs() can fail with -EEXIST while creating the
per-process procfs directory. The failure path calls
kobject_put(process->kobj) but leaves process->kobj non-NULL.
Later teardown may access the freed kobject and crash the kernel.

[Fix]

Clean backport of upstream commit:

4ea64d482fc2cc85009fce5abdf4780ece00c31c
("drm/amdkfd: fix kernel crash on releasing NULL sysfs entry")

The fix sets process->kobj to NULL after kobject_put() in the
failure path and makes kfd_procfs_del_queue() return when the
process has no valid kobject.

The fix is absent from the Resolute 7.0 kernels checked, including
7.0.0-34.34, 7.0.0-38.38, and Ubuntu-7.0.0-39.39 master-next.

[Test Plan]

Pre-fix:
- Seven kdump captures show the duplicate KFD procfs entry failure
  followed by a crash in the KFD process-release path.

Post-fix:
- On 7.0.0-31-generic with an amdgpu module rebuilt with this fix,
  the same -EEXIST procfs-creation failure path was observed 19
  times without a kernel Oops.
- The patched system subsequently ran approximately five days of
  ROCm workloads without kernel errors.

The trigger is timing-dependent. Attempts to construct a deterministic
reproducer did not re-trigger the -EEXIST path on demand, so a
deterministic before/after reproducer is not currently available.

[Where problems could occur]

The change is limited to the error path of per-process KFD procfs
creation and queue procfs cleanup when the process kobject is absent.

A regression would most likely appear as missing or incorrect
/sys/devices/virtual/kfd/kfd/proc/<pid> or queue entries for
processes that encounter this error path.

Eric Huang (1):
  drm/amdkfd: fix kernel crash on releasing NULL sysfs entry

 drivers/gpu/drm/amd/amdkfd/kfd_process.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--
2.53.0