[PATCH] accel/amdxdna: RCU-free the scheduler-containing hwctx private

[PATCH] accel/amdxdna: RCU-free the scheduler-containing hwctx private

[Jonghyuk Kim(MalHyuk)]

struct amdxdna_hwctx_priv embeds a struct drm_gpu_scheduler (priv->sched).
aie2_hwctx_fini() calls drm_sched_fini(&priv->sched) and then frees the whole
object with plain kfree(hwctx->priv).

Every drm_sched_fence produced by that scheduler stores fence->sched =
&priv->sched, and drm_sched_fence_get_timeline_name() returns
fence->sched->name.  The scheduler fence ops keep a .release callback, so the
fence is not ops-detached on signalling: a finished fence that userspace still
holds (exported via drm_syncobj / sync_file) keeps pointing at priv->sched
after the hwctx is torn down.  A later get_timeline_name() -- reachable
unprivileged through SYNC_IOC_FILE_INFO on the exported sync_file -- then
dereferences priv->sched->name in freed slab memory (KASAN
slab-use-after-free read).

This is the amdxdna instance of the dma-fence lifetime contract: the exporter
must keep the driver data backing a fence alive for an RCU grace period after
the fence is signalled, so a concurrent rcu_read_lock'd dma_fence_timeline_name()
cannot observe freed memory.  aie2_hwctx_fini() already waits for all submitted
jobs to complete/cancel, so the fences are signalled by teardown time; only the
teardown race window remains, which an RCU-delayed free closes.

Free the scheduler-containing private with kfree_rcu() instead of kfree().  The
init-failure unwind keeps plain kfree(): no job has been submitted there, so no
drm_sched_fence has been exported.

Fixes: be462c97b7df ("accel/amdxdna: Add hardware context")
Cc: stable@vger.kernel.org
Signed-off-by: Jonghyuk Kim(MalHyuk) <malhyuk97@gmail.com>
---
 drivers/accel/amdxdna/aie2_ctx.c | 2 +-
 drivers/accel/amdxdna/aie2_pci.h | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c
index 4b3a62aa8798..26bd6e001792 100644
--- a/drivers/accel/amdxdna/aie2_ctx.c
+++ b/drivers/accel/amdxdna/aie2_ctx.c
@@ -842,7 +842,7 @@ void aie2_hwctx_fini(struct amdxdna_hwctx *hwctx)
 
 	mutex_destroy(&hwctx->priv->io_lock);
 	kfree(hwctx->col_list);
-	kfree(hwctx->priv);
+	kfree_rcu(hwctx->priv, rcu);
 	kfree(hwctx->cus);
 }
 
diff --git a/drivers/accel/amdxdna/aie2_pci.h b/drivers/accel/amdxdna/aie2_pci.h
index ea1dac106400..e08b8f64328c 100644
--- a/drivers/accel/amdxdna/aie2_pci.h
+++ b/drivers/accel/amdxdna/aie2_pci.h
@@ -107,6 +107,8 @@ struct amdxdna_hwctx_priv {
 	struct amdxdna_gem_obj		*heap;
 	void				*mbox_chann;
 
+	struct rcu_head			rcu;
+
 	struct drm_gpu_scheduler	sched;
 	struct drm_sched_entity		entity;