[PATCH v3 0/6] drm/amdgpu: Robustness and safety fixes for ACA and RAS drivers

[Sreeraj S Kurup]

This patch series addresses several race conditions, boundary check bugs,
logic inversions, NULL pointer checks, and buffer size parameters across
the AMDGPU ACA (Accelerated Compute Architecture) and RAS driver
subsystems.

v2 -> v3:
  - Patch 3: Updated amdgpu_aca_get_error_data() to return 0 instead of
    -EOPNOTSUPP for invalid handles, ensuring global RAS error queries
    safely pass through non-ACA blocks without breaking telemetry.
  - Patch 6: Moved cancel_delayed_work_sync() in amdgpu_ras_fini() prior to
    ACA subsystem and lock cleanup to avoid teardown races and UAF.

v1 -> v2:
  - Patch 3: Updated remove_aca_handle() to use list_del_init() instead
    of list_del(), ensuring list_empty() properly evaluates removed
    handles and avoiding potential UAF during device teardown.

Sreeraj S Kurup (6):
  drm/amdgpu/aca: Fix race condition and UAF in error cache logging
  drm/amdgpu/aca: Add upper bounds check in aca_bank_hwip_is_matched
  drm/amdgpu/aca: Fix inverted validation logic and list cleanup
  drm/amdgpu/aca: Add missing NULL check for banks parameter in
    aca_banks_add_bank
  drm/amdgpu/aca: Fix off-by-one buffer size parameter in add_aca_sysfs
  drm/amdgpu/ras: Cancel delayed work before ACA teardown in
    amdgpu_ras_fini

 drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 35 ++++++++++---------------
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c |  3 +--
 2 files changed, 15 insertions(+), 23 deletions(-)

-- 
2.54.0