diff options
| author | Lizhi Hou <lizhi.hou@amd.com> | 2026-07-01 08:55:56 -0700 |
|---|---|---|
| committer | Lizhi Hou <lizhi.hou@amd.com> | 2026-07-01 14:57:45 -0700 |
| commit | ec3304ddfd99adf531244be3a35c77b52583d5d3 (patch) | |
| tree | 78b32794f087789874465c81ab7f61e6b6979051 /drivers/gpu | |
| parent | 613059875958e7b217b250ed14c3b189f9488421 (diff) | |
| download | linux-next-ec3304ddfd99adf531244be3a35c77b52583d5d3.tar.gz linux-next-ec3304ddfd99adf531244be3a35c77b52583d5d3.zip | |
accel/amdxdna: Fix use-after-free in debug BO command handling
When a debug BO command completes, job->drv_cmd may already have been
freed. Accessing it from aie2_sched_drvcmd_resp_handler() can result in
a use-after-free and memory corruption.
Fix this by introducing reference counting for drv_cmd objects and
transferring ownership to the job while it is in flight. This ensures
that the command remains valid until the completion handler finishes
processing it.
Fixes: 7ea046838021 ("accel/amdxdna: Support firmware debug buffer")
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260701155556.663541-1-lizhi.hou@amd.com
Diffstat (limited to 'drivers/gpu')
0 files changed, 0 insertions, 0 deletions