bybrooklyn/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-04-18 14:53:58 -04:00
Code Issues Packages Projects Releases Wiki Activity

drm/amdgpu/userqueue: Fix use after free in amdgpu_userq_buffer_vas_list_cleanup()

Browse Source 
The amdgpu_userq_buffer_va_list_del() function frees "va_cursor" but it
is dereferenced on the next line when we print the debug message.  Print
the debug message first and then free it.

Fixes: 2a28f9665d ("drm/amdgpu: track the userq bo va for its obj management")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
This commit is contained in:
Dan Carpenter
2025-10-22 14:03:24 +03:00
committed by Alex Deucher
parent 92b0a6ae66
commit 6142aa0660
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
View File

@@ -159,9 +159,9 @@ static int amdgpu_userq_buffer_vas_list_cleanup(struct amdgpu_device *adev,
r = -EINVAL;
goto err;
}
amdgpu_userq_buffer_va_list_del(mapping, va_cursor);
dev_dbg(adev->dev, "delete the userq:%p va:%llx\n",
queue, va_cursor->gpu_addr);
amdgpu_userq_buffer_va_list_del(mapping, va_cursor);
}
err:
amdgpu_bo_unreserve(queue->vm->root.bo);