• File: sys/dev/drm/amd/amdgpu/amdgpu_gfx.c
• Lines: 299–303
• Severity: Info
• CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U:C:N/I:N/A:L
• CWE: CWE-664 Improper control of a resource through its lifetime, CWE-820 missing sync of paired lock/unlock
• Confidence: likely
• Status: new

Summary

In amdgpu_gfx_kiq_init, if amdgpu_bo_reserve(kiq->eop_obj, true) returns non-zero, the code only dev_warn's and then unconditionally falls through to amdgpu_bo_kunmap + amdgpu_bo_unreserve.

Calling amdgpu_bo_unreserve (→ ttm_bo_unreserve) on a BO that was never reserved is an unbalanced reservation that TTM treats as a misuse.

Root cause

amdgpu_gfx.c:299-303:

r = amdgpu_bo_reserve(kiq->eop_obj, true);
if (unlikely(r != 0))
    dev_warn(...);            // no return / no goto
amdgpu_bo_kunmap(kiq->eop_obj);
amdgpu_bo_unreserve(kiq->eop_obj);

The error branch lacks return r; (or a goto skipping unreserve).

amdgpu_bo_unreserve (amdgpu_object.h:165-168) unconditionally calls ttm_bo_unreserve(&bo->tbo) with no held-reservation check, so on reserve failure this releases a reservation that is not held.

Threat model

Effectively unreachable. The BO was just created and pinned by amdgpu_bo_create_kernel at lines 289-291; nothing else can hold its reservation, so amdgpu_bo_reserve(..., true) succeeds in practice.

If it ever did fail (e.g. -ENOMEM deep in ttm_bo_reserve under extreme memory pressure), the result is a TTM reservation imbalance / kernel warning, i.e. local DoS at worst, during driver load — not controllable by an unprivileged user.

Recommended fix

Return on reserve failure so kunmap/unreserve are only called when the reservation is actually held:

--- a/sys/dev/drm/amd/amdgpu/amdgpu_gfx.c
+++ b/sys/dev/drm/amd/amdgpu/amdgpu_gfx.c
@@ -299,7 +299,7 @@ int amdgpu_gfx_kiq_init(struct amdgpu_device *adev,
    r = amdgpu_bo_reserve(kiq->eop_obj, true);
    if (unlikely(r != 0)) {
        dev_warn(adev->dev, "(%d) reserve kiq eop bo failed\n", r);
-   }
+       return r;
+   }
    amdgpu_bo_kunmap(kiq->eop_obj);
    amdgpu_bo_unreserve(kiq->eop_obj);

(Note: the upstream Linux version of this routine does not reserve at all here; matching that is also acceptable.)

References

• sys/dev/drm/amd/amdgpu/amdgpu_gfx.c:299-303 — missing early return on reserve failure
• sys/dev/drm/amd/amdgpu/amdgpu_object.h:165-168 — amdgpu_bo_unreserve has no held-check