]> git.baikalelectronics.ru Git - kernel.git/commit
drm/amdkfd: Correct mmu_notifier_get failure handling
authorPhilip Yang <Philip.Yang@amd.com>
Wed, 20 Jul 2022 22:00:45 +0000 (18:00 -0400)
committerAlex Deucher <alexander.deucher@amd.com>
Mon, 25 Jul 2022 13:31:05 +0000 (09:31 -0400)
commit124941f36ba25633b0620c9f195f23cefaa4b22b
treeea2d012d56f14e87c17827bb81033e1e7abf6881
parent4a51bbe0737d811e0d1570fe513e1306da2faf01
drm/amdkfd: Correct mmu_notifier_get failure handling

If process has signal pending, mmu_notifier_get_locked fails and calls
ops->free_notifier, kfd_process_free_notifier will schedule
kfd_process_wq_release as process refcount is 1, but process structure
is already freed. This use after free bug causes system crash with
different backtrace.

The fix is to increase process refcount and then decrease the refcount
after mmu_notifier_get success.

Signed-off-by: Philip Yang <Philip.Yang@amd.com>
Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drivers/gpu/drm/amd/amdkfd/kfd_process.c