Re: [PATCH] drm/amdkfd: Fix NULL Pointer Dereference in KFD queue

[Philip Yang]

On 2025-02-28 11:39, Andrew Martin wrote:
     Through KFD IOCTL Fuzzing we encountered a NULL pointer derefrence
     when calling kfd_queue_acquire_buffers.

Please remove the extra leading space character in subject and comment, 
and add tag

Fixes: 629568d25fea ("drm/amdkfd: Validate queue cwsr area and eop 
buffer size")

This patch is

Reviewed-by: Philip Yang <philip.y...@amd.com>

Signed-off-by: Andrew Martin <andrew.mar...@amd.com>
---
  drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c 
b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
index 62c635e9d1aa..dc2cdc48e28d 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
@@ -277,7 +277,7 @@ int kfd_queue_acquire_buffers(struct kfd_process_device 
*pdd, struct queue_prope
        if (properties->eop_ring_buffer_address) {
                if (properties->eop_ring_buffer_size != 
topo_dev->node_props.eop_buffer_size) {
                        pr_debug("queue eop bo size 0x%lx not equal to node eop buf 
size 0x%x\n",
-                               properties->eop_buf_bo->tbo.base.size,
+                               properties->eop_ring_buffer_size,
                                topo_dev->node_props.eop_buffer_size);
                        err = -EINVAL;
                        goto out_err_unreserve;