accel/amdxdna: Fix use-after-free of mm_struct in job scheduler

amdxdna_cmd_submit() stores current->mm in job->mm without holding any
reference. aie2_sched_job_run() later access job->mm from the DRM
scheduler worker thread. With only a raw pointer and no structural
reference, the mm_struct can be freed before the scheduler runs the job.

Fix this by calling mmgrab() to hold a structural mm_count reference for
the lifetime of the job, paired with mmdrop() in every cleanup path.

Fixes: aac243092b70 ("accel/amdxdna: Add command execution")
Reviewed-by: Max Zhen <max.zhen@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260716151305.1595780-1-lizhi.hou@amd.com

diff --git a/drivers/accel/amdxdna/amdxdna_ctx.c b/drivers/accel/amdxdna/amdxdna_ctx.c
index bdbd3db12a6c32bf1fa0f36fefc279ae00417de1..31a414c3f0d967b92f08d4882eab24b4aae42c03 100644 (file)
--- a/drivers/accel/amdxdna/amdxdna_ctx.c
+++ b/drivers/accel/amdxdna/amdxdna_ctx.c
@@ -577,6 +577,7 @@ void amdxdna_sched_job_cleanup(struct amdxdna_sched_job *job)
        amdxdna_arg_bos_put(job);
        amdxdna_gem_put_obj(job->cmd_bo);
        dma_fence_put(job->fence);
+       mmdrop(job->mm);
 }
 
 int amdxdna_cmd_submit(struct amdxdna_client *client,
@@ -642,6 +643,7 @@ int amdxdna_cmd_submit(struct amdxdna_client *client,
 
        job->hwctx = hwctx;
        job->mm = current->mm;
+       mmgrab(job->mm);
 
        job->fence = amdxdna_fence_create(hwctx);
        if (!job->fence) {
@@ -676,6 +678,8 @@ put_bos:
 cmd_put:
        amdxdna_gem_put_obj(job->cmd_bo);
 free_job:
+       if (job->mm)
+               mmdrop(job->mm);
        kfree(job);
        return ret;
 }