From d0c0ffdba93a589f78a67c264f8a4b4998e103c3 Mon Sep 17 00:00:00 2001 From: Lizhi Hou Date: Wed, 2 Sep 2026 11:09:54 -0700 Subject: [PATCH] accel/amdxdna: Disable BO import via flink Accessing abo->client in amdxdna_gem_del_bo_usage() may result in a use-after-free when the BO is imported via flink. Disable flink import by verifying that filp->driver_priv matches the client stored in abo->client before accessing the client. Fixes: 3cc5d7a59519 ("accel/amdxdna: Add carveout memory support for non-IOMMU systems") Reviewed-by: Max Zhen Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260902180955.3999242-1-lizhi.hou@amd.com --- drivers/accel/amdxdna/amdxdna_gem.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/accel/amdxdna/amdxdna_gem.c b/drivers/accel/amdxdna/amdxdna_gem.c index 3f05fa8811af..08e22829f72d 100644 --- a/drivers/accel/amdxdna/amdxdna_gem.c +++ b/drivers/accel/amdxdna/amdxdna_gem.c @@ -697,6 +697,8 @@ static int amdxdna_gem_obj_open(struct drm_gem_object *gobj, struct drm_file *fi int ret; guard(mutex)(&abo->lock); + if (abo->open_ref > 0 && filp->driver_priv != abo->client) + return -EPERM; abo->open_ref++; if (abo->open_ref > 1) return 0;