diff options
| author | Lizhi Hou <lizhi.hou@amd.com> | 2026-05-29 08:28:37 -0700 |
|---|---|---|
| committer | Lizhi Hou <lizhi.hou@amd.com> | 2026-06-03 11:45:47 -0700 |
| commit | 5d12ef71fbfd3b46c1319074e50f814215ae7f3b (patch) | |
| tree | 51ebce548dfc9f9d7af587719e58b669a6957a11 /drivers/accel | |
| parent | 90ae44d1e1bc67e8f6ceef56f184047c5fe775c7 (diff) | |
| download | linux-next-5d12ef71fbfd3b46c1319074e50f814215ae7f3b.tar.gz linux-next-5d12ef71fbfd3b46c1319074e50f814215ae7f3b.zip | |
accel/amdxdna: Remove drv_cmd tracing from job free callback
aie2_sched_job_free() accesses job->drv_cmd for tracing purposes. However,
job->drv_cmd is owned by the caller and may already have been freed when
the job free callback runs, leading to a potential use-after-free.
Remove the job->drv_cmd access from aie2_sched_job_free().
Fixes: 8711eb2dde2e ("accel/amdxdna: Improve tracing for job lifecycle and mailbox RX worker")
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260529152837.1973405-1-lizhi.hou@amd.com
Diffstat (limited to 'drivers/accel')
| -rw-r--r-- | drivers/accel/amdxdna/aie2_ctx.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c index 658a5fb1fda6..2ad343728782 100644 --- a/drivers/accel/amdxdna/aie2_ctx.c +++ b/drivers/accel/amdxdna/aie2_ctx.c @@ -437,8 +437,9 @@ static void aie2_sched_job_free(struct drm_sched_job *sched_job) struct amdxdna_sched_job *job = drm_job_to_xdna_job(sched_job); struct amdxdna_hwctx *hwctx = job->hwctx; + /* job->drv_cmd could be freed, so use DEFAULT_IO */ trace_xdna_job(sched_job, hwctx->name, "job free", - job->seq, job->drv_cmd ? job->drv_cmd->opcode : DEFAULT_IO); + job->seq, DEFAULT_IO); if (!job->job_done) up(&hwctx->priv->job_sem); |