Commit 6142aa06 authored by Dan Carpenter's avatar Dan Carpenter Committed by Alex Deucher
Browse files

drm/amdgpu/userqueue: Fix use after free in amdgpu_userq_buffer_vas_list_cleanup() 



The amdgpu_userq_buffer_va_list_del() function frees "va_cursor" but it
is dereferenced on the next line when we print the debug message.  Print
the debug message first and then free it.

Fixes: 2a28f966 ("drm/amdgpu: track the userq bo va for its obj management")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
parent 92b0a6ae

drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c

+1 −1
Original line number Diff line number Diff line
@@ -159,9 +159,9 @@ static int amdgpu_userq_buffer_vas_list_cleanup(struct amdgpu_device *adev, 
			r = -EINVAL;

			goto err;

		}

		amdgpu_userq_buffer_va_list_del(mapping, va_cursor);

		dev_dbg(adev->dev, "delete the userq:%p va:%llx\n",

			queue, va_cursor->gpu_addr);

		amdgpu_userq_buffer_va_list_del(mapping, va_cursor);

	}

err:

	amdgpu_bo_unreserve(queue->vm->root.bo);