Re: [PATCH V1 1/2] accel/amdxdna: Disable BO import via flink

[Max Zhen <max.zhen@amd.com>]

On 9/2/2026 Wed 11:09, Lizhi Hou wrote:
> Accessing abo->client in amdxdna_gem_del_bo_usage() may result in a
> use-after-free when the BO is imported via flink.
> 
> Disable flink import by verifing that filp->driver_priv matches the client
> stored in abo->client before accessing the client.
> 
> Fixes: 3cc5d7a59519 ("accel/amdxdna: Add carveout memory support for non-IOMMU systems")
> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Reviewed-by: Max Zhen <max.zhen@amd.com>
> ---
>   drivers/accel/amdxdna/amdxdna_gem.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/accel/amdxdna/amdxdna_gem.c b/drivers/accel/amdxdna/amdxdna_gem.c
> index 476649685e5a..1353393194e2 100644
> --- a/drivers/accel/amdxdna/amdxdna_gem.c
> +++ b/drivers/accel/amdxdna/amdxdna_gem.c
> @@ -697,6 +697,8 @@ static int amdxdna_gem_obj_open(struct drm_gem_object *gobj, struct drm_file *fi
>   	int ret;
>   
>   	guard(mutex)(&abo->lock);
> +	if (abo->open_ref > 0 && filp->driver_priv != abo->client)
> +		return -EPERM;
>   	abo->open_ref++;
>   	if (abo->open_ref > 1)
>   		return 0;