diff options
| author |  xinhui pan <xinhui.pan@amd.com>
| 2022-04-12 19:52:16 +0800 |
|---|---|---|
| committer |  Alex Deucher <alexander.deucher@amd.com>
| 2022-04-14 15:27:02 -0400 |
| commit | 7c703a7d3f2b50a6187267420a4d3d7e62fa3206 (patch) | |
| tree | 806324423a7a6952198ad363d07d073ef7ddb0ef /drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | |
| parent | drm/amdkfd: potential NULL dereference in kfd_set/reset_event() (diff) | |
| download | linux-7c703a7d3f2b50a6187267420a4d3d7e62fa3206.tar.gz linux-7c703a7d3f2b50a6187267420a4d3d7e62fa3206.tar.bz2 linux-7c703a7d3f2b50a6187267420a4d3d7e62fa3206.zip | |
drm/amdgpu: Fix one use-after-free of VM
VM might already be freed when amdgpu_vm_tlb_seq_cb() is called.
We see the calltrace below.
Fix it by keeping the last flush fence around and wait for it to signal
BUG kmalloc-4k (Not tainted): Poison overwritten
0xffff9c88630414e8-0xffff9c88630414e8 @offset=5352. First byte 0x6c
instead of 0x6b Allocated in amdgpu_driver_open_kms+0x9d/0x360 [amdgpu]
age=44 cpu=0 pid=2343
__slab_alloc.isra.0+0x4f/0x90
kmem_cache_alloc_trace+0x6b8/0x7a0
amdgpu_driver_open_kms+0x9d/0x360 [amdgpu]
drm_file_alloc+0x222/0x3e0 [drm]
drm_open+0x11d/0x410 [drm]
Freed in amdgpu_driver_postclose_kms+0x3e9/0x550 [amdgpu] age=22 cpu=1
pid=2485
kfree+0x4a2/0x580
amdgpu_driver_postclose_kms+0x3e9/0x550 [amdgpu]
drm_file_free+0x24e/0x3c0 [drm]
drm_close_helper.isra.0+0x90/0xb0 [drm]
drm_release+0x97/0x1a0 [drm]
__fput+0xb6/0x280
____fput+0xe/0x10
task_work_run+0x64/0xb0
Suggested-by: Christian König <christian.koenig@amd.com>
Signed-off-by: xinhui pan <xinhui.pan@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Diffstat (limited to 'drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h')
| -rw-r--r-- | drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h index 1a814fbffff8..6b06a214f05f 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h @@ -286,6 +286,7 @@ struct amdgpu_vm { /* Last finished delayed update */ atomic64_t tlb_seq; + struct dma_fence *last_tlb_flush; /* Last unlocked submission to the scheduler entities */ struct dma_fence *last_unlocked; |