Re: [PATCH v2 6/8] media: platform: amd: isp4 video node and buffers handling added

Sultan Alsawaf
2025-07-24T05:14:40Z

On Wed, Jul 23, 2025 at 10:55:48AM -0700, Sultan Alsawaf wrote:
> On Wed, Jun 18, 2025 at 05:19:57PM +0800, Bin Du wrote:
> > +
> > + buf->bo = (void *)bo;
> > + buf->gpu_addr = gpu_addr;
> > +
> > + refcount_set(&buf->refcount, 1);
>
> This discards the refcount inc triggered from amdgpu_bo_create_isp_user() when
> it calls get_dma_buf(), leading to a use-after-free. Move this refcount_set()
> up, preferably right after vmalloc_user() or right after `buf` is allocated so
> there's no risk of this issue occurring again in the future.

Following up to correct myself: please disregard this one comment from my
previous email since it's incorrect. Sorry for any confusion.

Sultan