• File: sys/dev/drm/amd/amdgpu/amdgpu_gfx.c
• Lines: 366, 373
• Severity: Info
• CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U:C:N/I:N/A:L
• CWE: CWE-415 Double free, CWE-911 Missing release of pointer after use
• Confidence: speculative
• Status: new

Summary

amdgpu_gfx_compute_mqd_sw_fini calls kfree(adev->gfx.mec.mqd_backup[i]) for each compute ring and for the KIQ slot [AMDGPU_MAX_COMPUTE_RINGS], but never sets the slot back to NULL.

The BO free on the same ring is idempotent (amdgpu_bo_free_kernel NULL-guards and amdgpu_bo_unref NULLs the pointer), but the raw kfree is not.

If the GFX IP-block sw_fini ever executed twice on the same adev, the second pass would double-free the same mqd_backup pointers.

Root cause

amdgpu_gfx.c:366: kfree(adev->gfx.mec.mqd_backup[i]); and amdgpu_gfx.c:373: kfree(adev->gfx.mec.mqd_backup[AMDGPU_MAX_COMPUTE_RINGS]); — neither is followed by mqd_backup[...] = NULL;.

Contrast the paired amdgpu_bo_free_kernel(&ring->mqd_obj, ...) which is safe to repeat because amdgpu_bo_free_kernel returns early on NULL (amdgpu_object.c:361) and amdgpu_bo_unref NULLs *bo.

Threat model

Speculative. amdgpu_device_ip sw_fini for the GFX block is invoked once during driver unload / device destroy; no error-retry or reset path re-enters amdgpu_gfx_compute_mqd_sw_fini on the same adev was found.

If such a path existed, the result would be a heap double-free → potential local privilege escalation via slab grooming, but no such path is demonstrated. Filed for hardening because the asymmetry (BO free idempotent, kfree not) is a genuine footgun.

Recommended fix

NULL each slot after kfree so the function becomes idempotent, matching the BO-free behavior:

--- a/sys/dev/drm/amd/amdgpu/amdgpu_gfx.c
+++ b/sys/dev/drm/amd/amdgpu/amdgpu_gfx.c
@@ -363,8 +363,11 @@ void amdgpu_gfx_compute_mqd_sw_fini(struct amdgpu_device *adev)
        amdgpu_bo_free_kernel(&ring->mqd_obj,
                      (u64 *)&ring->mqd_gpu_addr,
                      &ring->mqd_ptr);
+       adev->gfx.mec.mqd_backup[i] = NULL;
    }

    ring = &adev->gfx.kiq.ring;
    kfree(adev->gfx.mec.mqd_backup[AMDGPU_MAX_COMPUTE_RINGS]);
+   adev->gfx.mec.mqd_backup[AMDGPU_MAX_COMPUTE_RINGS] = NULL;
    amdgpu_bo_free_kernel(&ring->mqd_obj,

References

• sys/dev/drm/amd/amdgpu/amdgpu_gfx.c:366,373 — kfree without NULL
• sys/dev/drm/amd/amdgpu/amdgpu_object.c:361 — paired amdgpu_bo_free_kernel correctly NULL-guards