[PATCH v5 0/4] drm/amdgpu: Robustness and safety fixes for ACA and RAS drivers

[Sreeraj S Kurup]

This patch series addresses race conditions, boundary check bugs, logic
inversions, and teardown ordering in the AMDGPU ACA (Accelerated Compute
Architecture) and RAS driver subsystems.

v4 -> v5:
  - Dropped former Patch 4 (NULL check on banks parameter) and Patch 5
    (snprintf buffer size adjustment) from v5.
  - Patch 3: Dropped invalid kfree(handle) from remove_aca_handle()
    since ACA handles can be embedded in ras_manager. Removed non-existent
    mgr->lock references and retained list_del_init() prior to
    aca_fini_error_cache().
  - Patch 4 (formerly Patch 6): Retained the original work cancellation
    order in amdgpu_ras_fini() to prevent work re-queueing, while moving
    cancellation prior to mutex_destroy(&con->page_rsv_lock) in
    amdgpu_ras_recovery_fini().

v3 -> v4:
  - Patch 3: Moved node unlinking prior to aca_fini_error_cache().
  - Patch 4 (formerly Patch 6): Updated the subject and moved
    cancel_work_sync() and cancel_delayed_work_sync() prior to
    mutex_destroy(&con->page_rsv_lock) in amdgpu_ras_recovery_fini().

v2 -> v3:
  - Patch 3: Updated amdgpu_aca_get_error_data() to return 0 instead
    of -EOPNOTSUPP for invalid handles, allowing global RAS error
    queries to safely pass through non-ACA blocks.

v1 -> v2:
  - Patch 3: Updated remove_aca_handle() to use list_del_init()
    instead of list_del(), ensuring list_empty() correctly evaluates
    removed handles.

Sreeraj S Kurup (4):
  drm/amdgpu/aca: Fix race condition and UAF in error cache logging
  drm/amdgpu/aca: Add upper bounds check in aca_bank_hwip_is_matched
  drm/amdgpu/aca: Fix inverted validation logic and list cleanup
  drm/amdgpu/ras: Fix delayed work cancellation order during teardown

 drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 34 ++++++++++---------------
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c |  7 +++--
 2 files changed, 17 insertions(+), 24 deletions(-)

-- 
2.54.0