shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-07 03:15:31 +09:00
Code Issues Packages Projects Releases Wiki Activity

drm/amdkfd: Fix a race condition of vram buffer unref in svm code

Browse Source 
[ Upstream commit 709c348261618da7ed89d6c303e2ceb9e453ba74 ]

prange->svm_bo unref can happen in both mmu callback and a callback after
migrate to system ram. Both are async call in different tasks. Sync svm_bo
unref operation to avoid random "use-after-free".

Signed-off-by: Xiaogang Chen <xiaogang.chen@amd.com>
Reviewed-by: Philip Yang <Philip.Yang@amd.com>
Reviewed-by: Jesse Zhang <Jesse.Zhang@amd.com>
Tested-by: Jesse Zhang <Jesse.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Xiaogang Chen
2023-09-27 11:20:28 -05:00
committed by Greg Kroah-Hartman
parent eea81424c5
commit 7d43cdd22c
1 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/gpu/drm/amd/amdkfd/kfd_svm.c
View File

@@ -550,8 +550,15 @@ create_bo_failed:
void svm_range_vram_node_free(struct svm_range *prange) void svm_range_vram_node_free(struct svm_range *prange)
{ {
svm_range_bo_unref(prange->svm_bo); /* serialize prange->svm_bo unref */
prange->ttm_res = NULL; mutex_lock(&prange->lock);
/* prange->svm_bo has not been unref */
if (prange->ttm_res) {
prange->ttm_res = NULL;
mutex_unlock(&prange->lock);
svm_range_bo_unref(prange->svm_bo);
} else
mutex_unlock(&prange->lock);
} }
struct amdgpu_device * struct amdgpu_device *