Commit 13d0724f authored by Arvind Yadav's avatar Arvind Yadav Committed by Alex Deucher
Browse files

drm/amdgpu: fix use-after-unlock in eviction fence destroy 



The eviction fence destroy path incorrectly calls dma_fence_put() on
evf_mgr->ev_fence after releasing the ev_fence_lock. This introduces a
potential use-after-unlock or race because another thread concurrently
modifies evf_mgr->ev_fence.

Fix this by grabbing a local reference to evf_mgr->ev_fence under the
lock and using that for dma_fence_put() after waiting.

Cc: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: default avatarChristian König <christian.koenig@amd.com>
Reviewed-by: default avatarSunil Khatri <sunil.khatri@amd.com>
Signed-off-by: default avatarArvind Yadav <Arvind.Yadav@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
parent cc473057

drivers/gpu/drm/amd/amdgpu/amdgpu_eviction_fence.c

+1 −1
Original line number Diff line number Diff line
@@ -183,7 +183,7 @@ void amdgpu_eviction_fence_destroy(struct amdgpu_eviction_fence_mgr *evf_mgr) 
	dma_fence_wait(&ev_fence->base, false);



	/* Last unref of ev_fence */

	dma_fence_put(&evf_mgr->ev_fence->base);

	dma_fence_put(&ev_fence->base);

}



int amdgpu_eviction_fence_attach(struct amdgpu_eviction_fence_mgr *evf_mgr,