* [PATCH next] drm/amdgpu/userqueue: Fix use after free in amdgpu_userq_buffer_vas_list_cleanup()
@ 2025-10-22 11:03 Dan Carpenter
2025-10-22 14:07 ` Alex Deucher
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2025-10-22 11:03 UTC (permalink / raw)
To: Prike Liang
Cc: Alex Deucher, Christian König, David Airlie, Simona Vetter,
Sunil Khatri, Shashank Sharma, Arunpravin Paneer Selvam, amd-gfx,
dri-devel, linux-kernel, kernel-janitors
The amdgpu_userq_buffer_va_list_del() function frees "va_cursor" but it
is dereferenced on the next line when we print the debug message. Print
the debug message first and then free it.
Fixes: 2a28f9665dca ("drm/amdgpu: track the userq bo va for its obj management")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
index 9d4751a39c20..2200e0bbf040 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
@@ -159,9 +159,9 @@ static int amdgpu_userq_buffer_vas_list_cleanup(struct amdgpu_device *adev,
r = -EINVAL;
goto err;
}
- amdgpu_userq_buffer_va_list_del(mapping, va_cursor);
dev_dbg(adev->dev, "delete the userq:%p va:%llx\n",
queue, va_cursor->gpu_addr);
+ amdgpu_userq_buffer_va_list_del(mapping, va_cursor);
}
err:
amdgpu_bo_unreserve(queue->vm->root.bo);
--
2.51.0
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH next] drm/amdgpu/userqueue: Fix use after free in amdgpu_userq_buffer_vas_list_cleanup()
2025-10-22 11:03 [PATCH next] drm/amdgpu/userqueue: Fix use after free in amdgpu_userq_buffer_vas_list_cleanup() Dan Carpenter
@ 2025-10-22 14:07 ` Alex Deucher
0 siblings, 0 replies; 2+ messages in thread
From: Alex Deucher @ 2025-10-22 14:07 UTC (permalink / raw)
To: Dan Carpenter
Cc: Prike Liang, Alex Deucher, Christian König, David Airlie,
Simona Vetter, Sunil Khatri, Shashank Sharma,
Arunpravin Paneer Selvam, amd-gfx, dri-devel, linux-kernel,
kernel-janitors
Applied. Thanks!
Alex
On Wed, Oct 22, 2025 at 9:31 AM Dan Carpenter <dan.carpenter@linaro.org> wrote:
>
> The amdgpu_userq_buffer_va_list_del() function frees "va_cursor" but it
> is dereferenced on the next line when we print the debug message. Print
> the debug message first and then free it.
>
> Fixes: 2a28f9665dca ("drm/amdgpu: track the userq bo va for its obj management")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
> ---
> drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
> index 9d4751a39c20..2200e0bbf040 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
> @@ -159,9 +159,9 @@ static int amdgpu_userq_buffer_vas_list_cleanup(struct amdgpu_device *adev,
> r = -EINVAL;
> goto err;
> }
> - amdgpu_userq_buffer_va_list_del(mapping, va_cursor);
> dev_dbg(adev->dev, "delete the userq:%p va:%llx\n",
> queue, va_cursor->gpu_addr);
> + amdgpu_userq_buffer_va_list_del(mapping, va_cursor);
> }
> err:
> amdgpu_bo_unreserve(queue->vm->root.bo);
> --
> 2.51.0
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-10-23 7:51 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-10-22 11:03 [PATCH next] drm/amdgpu/userqueue: Fix use after free in amdgpu_userq_buffer_vas_list_cleanup() Dan Carpenter
2025-10-22 14:07 ` Alex Deucher
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.