drm/amdkfd: fix UAF race in destroy_queue_cpsch

wait_on_destroy_queue() drops locks to wait for queue resume, allowing
a concurrent destroy to free the queue. Use is_being_destroyed flag to
serialize destruction.

Reviewed-by: Amir Shetaia <Amir.Shetaia@amd.com>
Signed-off-by: Alysa Liu <Alysa.Liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit ac081deaf16a639ea7dff2f285fe421a33c1ade0)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
index 0d7296c739ed7bb942c13e9b4dd044657578f040..0a408f95baac85d5d4a04d5373c6be25d291b391 100644 (file)
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -2502,6 +2502,9 @@ static int wait_on_destroy_queue(struct device_queue_manager *dqm,
        if (pdd->qpd.is_debug)
                return ret;
 
+       if (q->properties.is_being_destroyed)
+               return -EBUSY;
+
        q->properties.is_being_destroyed = true;
 
        if (pdd->process->debug_trap_enabled && q->properties.is_suspended) {
@@ -2514,6 +2517,9 @@ static int wait_on_destroy_queue(struct device_queue_manager *dqm,
                dqm_lock(dqm);
        }
 
+       if (ret)
+               q->properties.is_being_destroyed = false;
+
        return ret;
 }
 
@@ -2607,7 +2613,7 @@ static int destroy_queue_cpsch(struct device_queue_manager *dqm,
        return retval;
 
 failed_try_destroy_debugged_queue:
-
+       q->properties.is_being_destroyed = false;
        dqm_unlock(dqm);
        return retval;
 }