drm/amdkfd: fix UAF race in destroy_queue_cpsch

Browse source

wait_on_destroy_queue() drops locks to wait for queue resume, allowing
a concurrent destroy to free the queue. Use is_being_destroyed flag to
serialize destruction.

Reviewed-by: Amir Shetaia <Amir.Shetaia@amd.com>
Signed-off-by: Alysa Liu <Alysa.Liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

...

This commit is contained in:

Alysa Liu 2026-05-27 11:31:35 -04:00 • committed by Alex Deucher

parent fbace613a5

commit ac081deaf1

1 changed files with 7 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

8

drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c

View file