From: shanzhulig Date: Wed, 28 Jun 2023 01:10:47 +0000 (-0700) Subject: drm/amdgpu: Fix potential fence use-after-free v2 X-Git-Tag: v6.6.7~2401^2~2^2 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=2e54154b9f27262efd0cb4f903cc7d5ad1fe9628;p=platform%2Fkernel%2Flinux-starfive.git drm/amdgpu: Fix potential fence use-after-free v2 fence Decrements the reference count before exiting. Avoid Race Vulnerabilities for fence use-after-free. v2 (chk): actually fix the use after free and not just move it. Signed-off-by: shanzhulig Signed-off-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher --- diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c index b34f9f8..040f4cb 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c @@ -1654,15 +1654,15 @@ static int amdgpu_cs_wait_all_fences(struct amdgpu_device *adev, continue; r = dma_fence_wait_timeout(fence, true, timeout); + if (r > 0 && fence->error) + r = fence->error; + dma_fence_put(fence); if (r < 0) return r; if (r == 0) break; - - if (fence->error) - return fence->error; } memset(wait, 0, sizeof(*wait));