From 0799087e2712fcc9efd849e3c99298ee2abac827 Mon Sep 17 00:00:00 2001 From: Mukul Joshi Date: Tue, 15 Sep 2026 22:17:02 -0400 Subject: [PATCH] drm/amdgpu: Reject UALink handle ioctl on devices without UALink amdgpu_gem_ualink_handle_ioctl() dereferences adev->ualink.info before validating it, but that structure is only allocated when the UALink IP block is present, which is currently added only for GFX 12.1 only. The ioctl is registered for every amdgpu device with DRM_RENDER_ALLOW, so on any other ASIC a render node user can oops the kernel with a single call. Return -EOPNOTSUPP when the UALink software state is absent. Fixes: 15d1c306d829 ("drm/amdgpu: Add ioctl infra for exporting/importing UALink handles") Reported-by: Sashiko-bot Closes: https://sashiko.dev/#/patchset/20260914054604.12850-1-kmehltretter@gmail.com?part=1 Signed-off-by: Mukul Joshi Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher --- drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c index 8411ea17172f..d55570d083f7 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c @@ -4072,10 +4072,15 @@ int amdgpu_gem_ualink_handle_ioctl(struct drm_device *dev, void *data, u32 gem_handle; int r, fd = -1; - if (adev->ualink.info->accel_state != - AMDGPU_UALINK_ACCEL_STATE_ACTIVE) { - dev_err(adev->dev, - "ualink device is not in active state in vpod\n"); + /* The ioctl is registered for every amdgpu device, but the UALink + * software state only exists on ASICs that instantiate the UALink IP + * block. Bail out if it is absent, and short-circuit before the + * accel_state dereference below. + */ + if (!adev->ualink.info || + adev->ualink.info->accel_state != AMDGPU_UALINK_ACCEL_STATE_ACTIVE) { + dev_dbg(adev->dev, + "ualink device not available or not in active state\n"); return -EOPNOTSUPP; }