tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

drm/amdgpu/userqueue: Fix use after free in amdgpu_userq_buffer_vas_list_cleanup()

The amdgpu_userq_buffer_va_list_del() function frees "va_cursor" but it
is dereferenced on the next line when we print the debug message. Print
the debug message first and then free it.

Fixes: 2a28f9665dca ("drm/amdgpu: track the userq bo va for its obj management")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

authored by

Dan Carpenter and committed by
Alex Deucher 6142aa06 92b0a6ae

+1 -1
+1 -1
drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
··· 159 159 r = -EINVAL; 160 160 goto err; 161 161 } 162 - amdgpu_userq_buffer_va_list_del(mapping, va_cursor); 163 162 dev_dbg(adev->dev, "delete the userq:%p va:%llx\n", 164 163 queue, va_cursor->gpu_addr); 164 + amdgpu_userq_buffer_va_list_del(mapping, va_cursor); 165 165 } 166 166 err: 167 167 amdgpu_bo_unreserve(queue->vm->root.bo);