]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
drm/amdgpu/userqueue: Fix use after free in amdgpu_userq_buffer_vas_list_cleanup()
authorDan Carpenter <dan.carpenter@linaro.org>
Wed, 22 Oct 2025 11:03:24 +0000 (14:03 +0300)
committerAlex Deucher <alexander.deucher@amd.com>
Tue, 28 Oct 2025 13:50:58 +0000 (09:50 -0400)
commit6142aa066061919a436c34c8a182674b48636311
treee49d1e799f289c4b90cbcb34257020b28b95b8c7
parent92b0a6ae6672857ddeabf892223943d2f0e06c97
drm/amdgpu/userqueue: Fix use after free in amdgpu_userq_buffer_vas_list_cleanup()

The amdgpu_userq_buffer_va_list_del() function frees "va_cursor" but it
is dereferenced on the next line when we print the debug message.  Print
the debug message first and then free it.

Fixes: 2a28f9665dca ("drm/amdgpu: track the userq bo va for its obj management")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c