Commit 6cdd8ee9 authored by Jack Xiao's avatar Jack Xiao Committed by Li Huafei
Browse files

drm/amdgpu/mes: fix use-after-free issue 

stable inclusion
from stable-v6.6.33
commit 39cfce75168c11421d70b8c0c65f6133edccb82a
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6SIE
CVE: CVE-2024-38581

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=39cfce75168c11421d70b8c0c65f6133edccb82a



--------------------------------

[ Upstream commit 948255282074d9367e01908b3f5dcf8c10fc9c3d ]

Delete fence fallback timer to fix the ramdom
use-after-free issue.

v2: move to amdgpu_mes.c

Signed-off-by: default avatarJack Xiao <Jack.Xiao@amd.com>
Acked-by: default avatarLijo Lazar <lijo.lazar@amd.com>
Acked-by: default avatarChristian König <christian.koenig@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarLi Huafei <lihuafei1@huawei.com>
parent 2cf566ed

drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c

+1 −0
Original line number Diff line number Diff line
@@ -1098,6 +1098,7 @@ void amdgpu_mes_remove_ring(struct amdgpu_device *adev, 
		return;



	amdgpu_mes_remove_hw_queue(adev, ring->hw_queue_id);

	del_timer_sync(&ring->fence_drv.fallback_timer);

	amdgpu_ring_fini(ring);

	kfree(ring);

}