drm/amdkfd: fix potential kgd_mem UAFs

Browse source

[ Upstream commit 9da050b0d9 ]

kgd_mem pointers returned by kfd_process_device_translate_handle are
only guaranteed to be valid while p->mutex is held. As soon as the mutex
is unlocked, another thread can free the BO.

Signed-off-by: Chia-I Wu <olvaffe@gmail.com>
Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

...

This commit is contained in:

Chia-I Wu 2023-03-08 13:37:24 -08:00 • committed by Greg Kroah-Hartman

parent e471c3c175

commit 5ca14fb555

1 changed files with 10 additions and 6 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

16

drivers/gpu/drm/amd/amdkfd/kfd_chardev.c

View file