]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
accel/amdxdna: Fix VMA access race
authorLizhi Hou <lizhi.hou@amd.com>
Tue, 9 Jun 2026 01:12:42 +0000 (18:12 -0700)
committerLizhi Hou <lizhi.hou@amd.com>
Tue, 7 Jul 2026 05:35:30 +0000 (22:35 -0700)
commit1ba02717e821cf14ece642273958647e79698d3d
tree8cc1236d0ed26e3746ade587397429ddd22cfa43
parent18aaebdf43366954345a6721ed2bff3ac3c9fa61
accel/amdxdna: Fix VMA access race

aie2_populate_range() and amdxdna_umap_release() access a saved VMA
pointer that may have already been freed, leading to a potential
use-after-free.

Remove the VMA accesses from these functions to avoid the race.

Fixes: e486147c912f ("accel/amdxdna: Add BO import and export")
Reviewed-by: Max Zhen <max.zhen@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260609011242.2833740-1-lizhi.hou@amd.com
drivers/accel/amdxdna/aie2_ctx.c
drivers/accel/amdxdna/amdxdna_gem.c
drivers/accel/amdxdna/amdxdna_gem.h