archives/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-03-08 04:04:43 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

accel/amdxdna: Hold mm structure across iommu_sva_unbind_device()

Browse source 
Some tests trigger a crash in iommu_sva_unbind_device() due to
accessing iommu_mm after the associated mm structure has been
freed.

Fix this by taking an explicit reference to the mm structure
after successfully binding the device, and releasing it only
after the device is unbound. This ensures the mm remains valid
for the entire SVA bind/unbind lifetime.

Fixes: be462c97b7 ("accel/amdxdna: Add hardware context")
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260128002356.1858122-1-lizhi.hou@amd.com
This commit is contained in:
Lizhi Hou 2026-01-27 16:23:56 -08:00
parent db7e7ea838
commit a9162439ad
2 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
drivers/accel/amdxdna/amdxdna_pci_drv.c
View file

@ -82,6 +82,8 @@ static int amdxdna_drm_open(struct drm_device *ddev, struct drm_file *filp)
ret = -ENODEV;
goto unbind_sva;
}
client->mm = current->mm;
mmgrab(client->mm);
init_srcu_struct(&client->hwctx_srcu);
xa_init_flags(&client->hwctx_xa, XA_FLAGS_ALLOC);
mutex_init(&client->mm_lock);
@ -116,6 +118,7 @@ static void amdxdna_client_cleanup(struct amdxdna_client *client)
drm_gem_object_put(to_gobj(client->dev_heap));
iommu_sva_unbind_device(client->sva);
mmdrop(client->mm);
kfree(client);
}

1
drivers/accel/amdxdna/amdxdna_pci_drv.h
View file

@ -130,6 +130,7 @@ struct amdxdna_client {
struct iommu_sva *sva;
int pasid;
struct mm_struct *mm;
};
#define amdxdna_for_each_hwctx(client, hwctx_id, entry) \