Commit cc4b5e03 authored by shanzhulig's avatar shanzhulig Committed by openeuler-sync-bot
Browse files

drm/amdgpu: Fix potential fence use-after-free v2 

mainline inclusion
from mainline-v6.5-rc1
commit 2e54154b
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8YD58
CVE: CVE-2023-51042

Reference: https://github.com/torvalds/linux/commit/2e54154b9f27262efd0cb4f903cc7d5ad1fe9628



--------------------------------

fence Decrements the reference count before exiting.
Avoid Race Vulnerabilities for fence use-after-free.

v2 (chk): actually fix the use after free and not just move it.

Signed-off-by: default avatarshanzhulig <shanzhulig@gmail.com>
Signed-off-by: default avatarChristian König <christian.koenig@amd.com>
Reviewed-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Signed-off-by: default avatarGUO Zihua <guozihua@huawei.com>
(cherry picked from commit 7a514405)
parent 31ca0b66

drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c

+3 −3
Original line number Diff line number Diff line
@@ -1517,15 +1517,15 @@ static int amdgpu_cs_wait_all_fences(struct amdgpu_device *adev, 
			continue;



		r = dma_fence_wait_timeout(fence, true, timeout);

		if (r > 0 && fence->error)

			r = fence->error;



		dma_fence_put(fence);

		if (r < 0)

			return r;



		if (r == 0)

			break;



		if (fence->error)

			return fence->error;

	}



	memset(wait, 0, sizeof(*wait));