]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
accel/amdxdna: Fix amdxdna_client lifetime race during device removal
authorLizhi Hou <lizhi.hou@amd.com>
Thu, 11 Jun 2026 05:51:48 +0000 (22:51 -0700)
committerLizhi Hou <lizhi.hou@amd.com>
Mon, 29 Jun 2026 17:33:30 +0000 (10:33 -0700)
commit1dbbc7f98cde1e2433c1b1617053ae2ffab00086
tree4bf55b004690200e9302f16bf4ad4328888a9d24
parent00599d4841790d05401820a96cf7edb193888b00
accel/amdxdna: Fix amdxdna_client lifetime race during device removal

In amdxdna_remove(), all amdxdna_client structures are freed after
calling drm_dev_unplug(). However, drm_dev_unplug() does not force
existing file descriptors to be closed, so amdxdna_drm_close() may be
called after amdxdna_remove() has completed.

As a result, accessing client->pid for debug output in
amdxdna_drm_close() can lead to a use-after-free, since the access is
not protected by drm_dev_enter().

Fix this by decoupling hardware teardown from client cleanup.
amdxdna_remove() only performs hardware-related cleanup, while
per-client resources are released from amdxdna_drm_close() when the
corresponding file is closed.

Fixes: be462c97b7df ("accel/amdxdna: Add hardware context")
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260611055150.3070216-1-lizhi.hou@amd.com
drivers/accel/amdxdna/amdxdna_pci_drv.c
drivers/accel/amdxdna/amdxdna_pci_drv.h