drm/amdgpu: Fix use-after-free race in VM acquire

Replace non-atomic vm->process_info assignment with cmpxchg()
to prevent race when parent/child processes sharing a drm_file
both try to acquire the same VM after fork().

Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
Signed-off-by: Alysa Liu <Alysa.Liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit c7c573275ec20db05be769288a3e3bb2250ec618)
Cc: stable@vger.kernel.org

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
index 06c1913d5a3f269a42d86d7d61953e607f0abe8d..29b400cdd6d5f97237556988f3c9f7aa222f562b 100644 (file)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
@@ -1439,7 +1439,10 @@ static int init_kfd_vm(struct amdgpu_vm *vm, void **process_info,
                *process_info = info;
        }
 
-       vm->process_info = *process_info;
+       if (cmpxchg(&vm->process_info, NULL, *process_info) != NULL) {
+               ret = -EINVAL;
+               goto already_acquired;
+       }
 
        /* Validate page directory and attach eviction fence */
        ret = amdgpu_bo_reserve(vm->root.bo, true);
@@ -1479,6 +1482,7 @@ validate_pd_fail:
        amdgpu_bo_unreserve(vm->root.bo);
 reserve_pd_fail:
        vm->process_info = NULL;
+already_acquired:
        if (info) {
                dma_fence_put(&info->eviction_fence->base);
                *process_info = NULL;