accel/amdxdna: Fix potential amdxdna_umap lifetime race

amdxdna_umap_release() calls the blocking mmu_interval_notifier_remove()
before removing the object from abo->mem.umap_list. If
aie2_populate_range() runs concurrently, it may obtain a reference to an
amdxdna_umap that is being released, leading to a potential use-after-free.

Use kref_get_unless_zero() in aie2_populate_range() when acquiring a
reference. If the reference count has already dropped to zero, release
is in progress and the entry is skipped.

Fixes: e486147c912f ("accel/amdxdna: Add BO import and export")
Reviewed-by: Max Zhen <max.zhen@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260706221228.434099-1-lizhi.hou@amd.com

diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c
index 408ff7e2a272ba04c8d2266b89e9f90d05a57583..7bf635634e64e392f801532595a7c69db7bc3f48 100644 (file)
--- a/drivers/accel/amdxdna/aie2_ctx.c
+++ b/drivers/accel/amdxdna/aie2_ctx.c
@@ -1039,7 +1039,7 @@ again:
        found = false;
        down_write(&xdna->notifier_lock);
        list_for_each_entry(mapp, &abo->mem.umap_list, node) {
-               if (mapp->invalid) {
+               if (mapp->invalid && kref_get_unless_zero(&mapp->refcnt)) {
                        found = true;
                        break;
                }
@@ -1050,7 +1050,7 @@ again:
                up_write(&xdna->notifier_lock);
                return 0;
        }
-       kref_get(&mapp->refcnt);
+
        up_write(&xdna->notifier_lock);
 
        mm = mapp->notifier.mm;