Commit a9162439 authored by Lizhi Hou's avatar Lizhi Hou
Browse files

accel/amdxdna: Hold mm structure across iommu_sva_unbind_device() 



Some tests trigger a crash in iommu_sva_unbind_device() due to
accessing iommu_mm after the associated mm structure has been
freed.

Fix this by taking an explicit reference to the mm structure
after successfully binding the device, and releasing it only
after the device is unbound. This ensures the mm remains valid
for the entire SVA bind/unbind lifetime.

Fixes: be462c97 ("accel/amdxdna: Add hardware context")
Reviewed-by: default avatarMario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: default avatarLizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260128002356.1858122-1-lizhi.hou@amd.com
parent db7e7ea8

drivers/accel/amdxdna/amdxdna_pci_drv.c

+3 −0
Original line number Diff line number Diff line
@@ -82,6 +82,8 @@ static int amdxdna_drm_open(struct drm_device *ddev, struct drm_file *filp) 
		ret = -ENODEV;

		goto unbind_sva;

	}

	client->mm = current->mm;

	mmgrab(client->mm);

	init_srcu_struct(&client->hwctx_srcu);

	xa_init_flags(&client->hwctx_xa, XA_FLAGS_ALLOC);

	mutex_init(&client->mm_lock);
@@ -116,6 +118,7 @@ static void amdxdna_client_cleanup(struct amdxdna_client *client) 
		drm_gem_object_put(to_gobj(client->dev_heap));



	iommu_sva_unbind_device(client->sva);

	mmdrop(client->mm);



	kfree(client);

}

drivers/accel/amdxdna/amdxdna_pci_drv.h

+1 −0
Original line number Diff line number Diff line
@@ -130,6 +130,7 @@ struct amdxdna_client { 


	struct iommu_sva		*sva;

	int				pasid;

	struct mm_struct		*mm;

};



#define amdxdna_for_each_hwctx(client, hwctx_id, entry)		\