Re: [PATCH V1] accel/amdxdna: Fix potential amdxdna_umap lifetime race

[Max Zhen <max.zhen@amd.com>]

On 7/6/2026 Mon 15:12, Lizhi Hou wrote:
> amdxdna_umap_release() calls the blocking mmu_interval_notifier_remove()
> before removing the object from abo->mem.umap_list. If
> aie2_populate_range() runs concurrently, it may obtain a reference to an
> amdxdna_umap that is being released, leading to a potential use-after-free.
> 
> Use refcount_inc_not_zero() in aie2_populate_range() when acquiring a
> reference. If the reference count has already dropped to zero, release
> is in progress and the entry is skipped.
> 
> Fixes: e486147c912f ("accel/amdxdna: Add BO import and export")
> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Reviewed-by: Max Zhen <max.zhen@amd.com>

The patch description mentioned refcount_inc_not_zero(), but the real 
fix calls kref_get_unless_zero() which is a wrapper of 
refcount_inc_not_zero(). It might be better to fix the description to 
match the fix in the code.

Thanks,
Max
> ---
>   drivers/accel/amdxdna/aie2_ctx.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c
> index 408ff7e2a272..7bf635634e64 100644
> --- a/drivers/accel/amdxdna/aie2_ctx.c
> +++ b/drivers/accel/amdxdna/aie2_ctx.c
> @@ -1039,7 +1039,7 @@ static int aie2_populate_range(struct amdxdna_gem_obj *abo)
>   	found = false;
>   	down_write(&xdna->notifier_lock);
>   	list_for_each_entry(mapp, &abo->mem.umap_list, node) {
> -		if (mapp->invalid) {
> +		if (mapp->invalid && kref_get_unless_zero(&mapp->refcnt)) {
>   			found = true;
>   			break;
>   		}
> @@ -1050,7 +1050,7 @@ static int aie2_populate_range(struct amdxdna_gem_obj *abo)
>   		up_write(&xdna->notifier_lock);
>   		return 0;
>   	}
> -	kref_get(&mapp->refcnt);
> +
>   	up_write(&xdna->notifier_lock);
>   
>   	mm = mapp->notifier.mm;