diff options
| author | Lizhi Hou <lizhi.hou@amd.com> | 2026-07-06 15:12:28 -0700 |
|---|---|---|
| committer | Lizhi Hou <lizhi.hou@amd.com> | 2026-07-07 10:00:04 -0700 |
| commit | 14f172eff9c19f8043a9858845f33cd034f3a41e (patch) | |
| tree | 7cd1c46d5edd56dc5abdf6031b7bc75b9539734c /drivers | |
| parent | ac7c6b4308c5e757eb278d47b9c0761c31ac9d6b (diff) | |
| download | linux-14f172eff9c19f8043a9858845f33cd034f3a41e.tar.gz linux-14f172eff9c19f8043a9858845f33cd034f3a41e.zip | |
accel/amdxdna: Fix potential amdxdna_umap lifetime race
amdxdna_umap_release() calls the blocking mmu_interval_notifier_remove()
before removing the object from abo->mem.umap_list. If
aie2_populate_range() runs concurrently, it may obtain a reference to an
amdxdna_umap that is being released, leading to a potential use-after-free.
Use kref_get_unless_zero() in aie2_populate_range() when acquiring a
reference. If the reference count has already dropped to zero, release
is in progress and the entry is skipped.
Fixes: e486147c912f ("accel/amdxdna: Add BO import and export")
Reviewed-by: Max Zhen <max.zhen@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260706221228.434099-1-lizhi.hou@amd.com
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/accel/amdxdna/aie2_ctx.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c index 408ff7e2a272..7bf635634e64 100644 --- a/drivers/accel/amdxdna/aie2_ctx.c +++ b/drivers/accel/amdxdna/aie2_ctx.c @@ -1039,7 +1039,7 @@ again: found = false; down_write(&xdna->notifier_lock); list_for_each_entry(mapp, &abo->mem.umap_list, node) { - if (mapp->invalid) { + if (mapp->invalid && kref_get_unless_zero(&mapp->refcnt)) { found = true; break; } @@ -1050,7 +1050,7 @@ again: up_write(&xdna->notifier_lock); return 0; } - kref_get(&mapp->refcnt); + up_write(&xdna->notifier_lock); mm = mapp->notifier.mm; |