drm/amdkfd: Correct mmu_notifier_get failure handling
authorPhilip Yang <Philip.Yang@amd.com>
Wed, 20 Jul 2022 22:00:45 +0000 (18:00 -0400)
committerAlex Deucher <alexander.deucher@amd.com>
Mon, 25 Jul 2022 13:31:05 +0000 (09:31 -0400)
commit0593ad215359d51514c1e6c81ce28ea598efed6b
treeea2d012d56f14e87c17827bb81033e1e7abf6881
parent1c05d9e53d2cfad1f99d9087a8ad24da4ebc0905
drm/amdkfd: Correct mmu_notifier_get failure handling

If process has signal pending, mmu_notifier_get_locked fails and calls
ops->free_notifier, kfd_process_free_notifier will schedule
kfd_process_wq_release as process refcount is 1, but process structure
is already freed. This use after free bug causes system crash with
different backtrace.

The fix is to increase process refcount and then decrease the refcount
after mmu_notifier_get success.

Signed-off-by: Philip Yang <Philip.Yang@amd.com>
Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drivers/gpu/drm/amd/amdkfd/kfd_process.c