github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

accel/amdxdna: Disable BO import via flink

Browse Source 
Accessing abo->client in amdxdna_gem_del_bo_usage() may result in a
use-after-free when the BO is imported via flink.

Disable flink import by verifying that filp->driver_priv matches the client
stored in abo->client before accessing the client.

Fixes: 3cc5d7a595 ("accel/amdxdna: Add carveout memory support for non-IOMMU systems")
Reviewed-by: Max Zhen <max.zhen@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260902180955.3999242-1-lizhi.hou@amd.com
This commit is contained in:
Lizhi Hou 2026-09-02 11:09:54 -07:00
parent 2350f42c2f
commit d0c0ffdba9
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/accel/amdxdna/amdxdna_gem.c
View File

@ -697,6 +697,8 @@ static int amdxdna_gem_obj_open(struct drm_gem_object *gobj, struct drm_file *fi
int ret;
guard(mutex)(&abo->lock);
if (abo->open_ref > 0 && filp->driver_priv != abo->client)
return -EPERM;
abo->open_ref++;
if (abo->open_ref > 1)
return 0;