kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/drivers/accel
History
Lizhi Hou faebb7ba1a accel/amdxdna: Fix use-after-free of mm_struct in job scheduler 
amdxdna_cmd_submit() stores current->mm in job->mm without holding any
reference. aie2_sched_job_run() later access job->mm from the DRM
scheduler worker thread. With only a raw pointer and no structural
reference, the mm_struct can be freed before the scheduler runs the job.

Fix this by calling mmgrab() to hold a structural mm_count reference for
the lifetime of the job, paired with mmdrop() in every cleanup path.

Fixes: aac243092b ("accel/amdxdna: Add command execution")
Reviewed-by: Max Zhen <max.zhen@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260716151305.1595780-1-lizhi.hou@amd.com
History 2026-07-16 20:05:28 -07:00
..
amdxdna accel/amdxdna: Fix use-after-free of mm_struct in job scheduler 2026-07-16 20:05:28 -07:00
ethosu Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
habanalabs Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses 2026-02-22 08:26:33 -08:00
ivpu accel/ivpu: Reject firmware log with size smaller than header 2026-07-15 16:17:10 +02:00
qaic Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
rocket drm-next for 7.2-rc1 2026-06-17 10:21:00 +01:00
drm_accel.c drm: move drm based debugfs funcs to drm_debugfs.c 2025-07-04 15:58:22 +02:00
Kconfig accel: Add Arm Ethos-U NPU driver 2025-10-24 15:07:39 -05:00
Makefile accel: Add Arm Ethos-U NPU driver 2025-10-24 15:07:39 -05:00