mirror of
https://github.com/torvalds/linux.git
synced 2026-09-14 16:10:02 +02:00
14f172eff9
amdxdna_umap_release() calls the blocking mmu_interval_notifier_remove()
before removing the object from abo->mem.umap_list. If
aie2_populate_range() runs concurrently, it may obtain a reference to an
amdxdna_umap that is being released, leading to a potential use-after-free.
Use kref_get_unless_zero() in aie2_populate_range() when acquiring a
reference. If the reference count has already dropped to zero, release
is in progress and the entry is skipped.
Fixes:
|
||
|---|---|---|
| .. | ||
| amdxdna | ||
| ethosu | ||
| habanalabs | ||
| ivpu | ||
| qaic | ||
| rocket | ||
| drm_accel.c | ||
| Kconfig | ||
| Makefile | ||