| From c40edde3756deade9ab970be698727d90fd79f27 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 27 Jun 2023 18:10:47 -0700 |
| Subject: drm/amdgpu: Fix potential fence use-after-free v2 |
| MIME-Version: 1.0 |
| Content-Type: text/plain; charset=UTF-8 |
| Content-Transfer-Encoding: 8bit |
| |
| From: shanzhulig <shanzhulig@gmail.com> |
| |
| [ Upstream commit 2e54154b9f27262efd0cb4f903cc7d5ad1fe9628 ] |
| |
| fence Decrements the reference count before exiting. |
| Avoid Race Vulnerabilities for fence use-after-free. |
| |
| v2 (chk): actually fix the use after free and not just move it. |
| |
| Signed-off-by: shanzhulig <shanzhulig@gmail.com> |
| Signed-off-by: Christian Kรถnig <christian.koenig@amd.com> |
| Reviewed-by: Alex Deucher <alexander.deucher@amd.com> |
| Signed-off-by: Alex Deucher <alexander.deucher@amd.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 6 +++--- |
| 1 file changed, 3 insertions(+), 3 deletions(-) |
| |
| diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c |
| index feb48bb0b4494..0c023269aadaa 100644 |
| --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c |
| +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c |
| @@ -1625,15 +1625,15 @@ static int amdgpu_cs_wait_all_fences(struct amdgpu_device *adev, |
| continue; |
| |
| r = dma_fence_wait_timeout(fence, true, timeout); |
| + if (r > 0 && fence->error) |
| + r = fence->error; |
| + |
| dma_fence_put(fence); |
| if (r < 0) |
| return r; |
| |
| if (r == 0) |
| break; |
| - |
| - if (fence->error) |
| - return fence->error; |
| } |
| |
| memset(wait, 0, sizeof(*wait)); |
| -- |
| 2.40.1 |
| |
