Re: [PATCH V1 1/2] accel/amdxdna: Disable BO import via flink

[Lizhi Hou <lizhi.hou@amd.com>]

Applied to drm-misc-next

On 9/2/26 11:48, Max Zhen wrote:
>
>
> On 9/2/2026 Wed 11:09, Lizhi Hou wrote:
>> Accessing abo->client in amdxdna_gem_del_bo_usage() may result in a
>> use-after-free when the BO is imported via flink.
>>
>> Disable flink import by verifing that filp->driver_priv matches the 
>> client
>> stored in abo->client before accessing the client.
>>
>> Fixes: 3cc5d7a59519 ("accel/amdxdna: Add carveout memory support for 
>> non-IOMMU systems")
>> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
> Reviewed-by: Max Zhen <max.zhen@amd.com>
>> ---
>>   drivers/accel/amdxdna/amdxdna_gem.c | 2 ++
>>   1 file changed, 2 insertions(+)
>>
>> diff --git a/drivers/accel/amdxdna/amdxdna_gem.c 
>> b/drivers/accel/amdxdna/amdxdna_gem.c
>> index 476649685e5a..1353393194e2 100644
>> --- a/drivers/accel/amdxdna/amdxdna_gem.c
>> +++ b/drivers/accel/amdxdna/amdxdna_gem.c
>> @@ -697,6 +697,8 @@ static int amdxdna_gem_obj_open(struct 
>> drm_gem_object *gobj, struct drm_file *fi
>>       int ret;
>>         guard(mutex)(&abo->lock);
>> +    if (abo->open_ref > 0 && filp->driver_priv != abo->client)
>> +        return -EPERM;
>>       abo->open_ref++;
>>       if (abo->open_ref > 1)
>>           return 0;
>