[PATCH V1] accel/amdxdna: Fix potential amdxdna_umap lifetime race

[PATCH V1] accel/amdxdna: Fix potential amdxdna_umap lifetime race

[Lizhi Hou]

amdxdna_umap_release() calls the blocking mmu_interval_notifier_remove()
before removing the object from abo->mem.umap_list. If
aie2_populate_range() runs concurrently, it may obtain a reference to an
amdxdna_umap that is being released, leading to a potential use-after-free.

Use refcount_inc_not_zero() in aie2_populate_range() when acquiring a
reference. If the reference count has already dropped to zero, release
is in progress and the entry is skipped.

Fixes: e486147c912f ("accel/amdxdna: Add BO import and export")
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
---
 drivers/accel/amdxdna/aie2_ctx.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c
index 408ff7e2a272..7bf635634e64 100644
--- a/drivers/accel/amdxdna/aie2_ctx.c
+++ b/drivers/accel/amdxdna/aie2_ctx.c
@@ -1039,7 +1039,7 @@ static int aie2_populate_range(struct amdxdna_gem_obj *abo)
 	found = false;
 	down_write(&xdna->notifier_lock);
 	list_for_each_entry(mapp, &abo->mem.umap_list, node) {
-		if (mapp->invalid) {
+		if (mapp->invalid && kref_get_unless_zero(&mapp->refcnt)) {
 			found = true;
 			break;
 		}
@@ -1050,7 +1050,7 @@ static int aie2_populate_range(struct amdxdna_gem_obj *abo)
 		up_write(&xdna->notifier_lock);
 		return 0;
 	}
-	kref_get(&mapp->refcnt);
+
 	up_write(&xdna->notifier_lock);
 
 	mm = mapp->notifier.mm;
-- 
2.34.1

Re: [PATCH V1] accel/amdxdna: Fix potential amdxdna_umap lifetime race

[Max Zhen]

On 7/6/2026 Mon 15:12, Lizhi Hou wrote:
> amdxdna_umap_release() calls the blocking mmu_interval_notifier_remove()
> before removing the object from abo->mem.umap_list. If
> aie2_populate_range() runs concurrently, it may obtain a reference to an
> amdxdna_umap that is being released, leading to a potential use-after-free.
> 
> Use refcount_inc_not_zero() in aie2_populate_range() when acquiring a
> reference. If the reference count has already dropped to zero, release
> is in progress and the entry is skipped.
> 
> Fixes: e486147c912f ("accel/amdxdna: Add BO import and export")
> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Reviewed-by: Max Zhen <max.zhen@amd.com>

The patch description mentioned refcount_inc_not_zero(), but the real 
fix calls kref_get_unless_zero() which is a wrapper of 
refcount_inc_not_zero(). It might be better to fix the description to 
match the fix in the code.

Thanks,
Max
> ---
>   drivers/accel/amdxdna/aie2_ctx.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c
> index 408ff7e2a272..7bf635634e64 100644
> --- a/drivers/accel/amdxdna/aie2_ctx.c
> +++ b/drivers/accel/amdxdna/aie2_ctx.c
> @@ -1039,7 +1039,7 @@ static int aie2_populate_range(struct amdxdna_gem_obj *abo)
>   	found = false;
>   	down_write(&xdna->notifier_lock);
>   	list_for_each_entry(mapp, &abo->mem.umap_list, node) {
> -		if (mapp->invalid) {
> +		if (mapp->invalid && kref_get_unless_zero(&mapp->refcnt)) {
>   			found = true;
>   			break;
>   		}
> @@ -1050,7 +1050,7 @@ static int aie2_populate_range(struct amdxdna_gem_obj *abo)
>   		up_write(&xdna->notifier_lock);
>   		return 0;
>   	}
> -	kref_get(&mapp->refcnt);
> +
>   	up_write(&xdna->notifier_lock);
>   
>   	mm = mapp->notifier.mm;

Re: [PATCH V1] accel/amdxdna: Fix potential amdxdna_umap lifetime race

[Lizhi Hou]

Applied to drm-misc-fixes

On 7/7/26 08:35, Max Zhen wrote:
>
>
> On 7/6/2026 Mon 15:12, Lizhi Hou wrote:
>> amdxdna_umap_release() calls the blocking mmu_interval_notifier_remove()
>> before removing the object from abo->mem.umap_list. If
>> aie2_populate_range() runs concurrently, it may obtain a reference to an
>> amdxdna_umap that is being released, leading to a potential 
>> use-after-free.
>>
>> Use refcount_inc_not_zero() in aie2_populate_range() when acquiring a
>> reference. If the reference count has already dropped to zero, release
>> is in progress and the entry is skipped.
>>
>> Fixes: e486147c912f ("accel/amdxdna: Add BO import and export")
>> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
> Reviewed-by: Max Zhen <max.zhen@amd.com>
>
> The patch description mentioned refcount_inc_not_zero(), but the real 
> fix calls kref_get_unless_zero() which is a wrapper of 
> refcount_inc_not_zero(). It might be better to fix the description to 
> match the fix in the code.
>
> Thanks,
> Max
>> ---
>>   drivers/accel/amdxdna/aie2_ctx.c | 4 ++--
>>   1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/accel/amdxdna/aie2_ctx.c 
>> b/drivers/accel/amdxdna/aie2_ctx.c
>> index 408ff7e2a272..7bf635634e64 100644
>> --- a/drivers/accel/amdxdna/aie2_ctx.c
>> +++ b/drivers/accel/amdxdna/aie2_ctx.c
>> @@ -1039,7 +1039,7 @@ static int aie2_populate_range(struct 
>> amdxdna_gem_obj *abo)
>>       found = false;
>>       down_write(&xdna->notifier_lock);
>>       list_for_each_entry(mapp, &abo->mem.umap_list, node) {
>> -        if (mapp->invalid) {
>> +        if (mapp->invalid && kref_get_unless_zero(&mapp->refcnt)) {
>>               found = true;
>>               break;
>>           }
>> @@ -1050,7 +1050,7 @@ static int aie2_populate_range(struct 
>> amdxdna_gem_obj *abo)
>>           up_write(&xdna->notifier_lock);
>>           return 0;
>>       }
>> -    kref_get(&mapp->refcnt);
>> +
>>       up_write(&xdna->notifier_lock);
>>         mm = mapp->notifier.mm;
>