[PATCH V1] accel/amdxdna: Fix use-after-free of mm_struct in job scheduler

[PATCH V1] accel/amdxdna: Fix use-after-free of mm_struct in job scheduler

[Lizhi Hou]

amdxdna_cmd_submit() stores current->mm in job->mm without holding any
reference. aie2_sched_job_run() later access job->mm from the DRM
scheduler worker thread. With only a raw pointer and no structural
reference, the mm_struct can be freed before the scheduler runs the job.

Fix this by calling mmgrab() to hold a structural mm_count reference for
the lifetime of the job, paired with mmdrop() in every cleanup path.

Fixes: aac243092b70 ("accel/amdxdna: Add command execution")
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
---
 drivers/accel/amdxdna/amdxdna_ctx.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/accel/amdxdna/amdxdna_ctx.c b/drivers/accel/amdxdna/amdxdna_ctx.c
index bdbd3db12a6c..31a414c3f0d9 100644
--- a/drivers/accel/amdxdna/amdxdna_ctx.c
+++ b/drivers/accel/amdxdna/amdxdna_ctx.c
@@ -577,6 +577,7 @@ void amdxdna_sched_job_cleanup(struct amdxdna_sched_job *job)
 	amdxdna_arg_bos_put(job);
 	amdxdna_gem_put_obj(job->cmd_bo);
 	dma_fence_put(job->fence);
+	mmdrop(job->mm);
 }
 
 int amdxdna_cmd_submit(struct amdxdna_client *client,
@@ -642,6 +643,7 @@ int amdxdna_cmd_submit(struct amdxdna_client *client,
 
 	job->hwctx = hwctx;
 	job->mm = current->mm;
+	mmgrab(job->mm);
 
 	job->fence = amdxdna_fence_create(hwctx);
 	if (!job->fence) {
@@ -676,6 +678,8 @@ int amdxdna_cmd_submit(struct amdxdna_client *client,
 cmd_put:
 	amdxdna_gem_put_obj(job->cmd_bo);
 free_job:
+	if (job->mm)
+		mmdrop(job->mm);
 	kfree(job);
 	return ret;
 }
-- 
2.34.1

Re: [PATCH V1] accel/amdxdna: Fix use-after-free of mm_struct in job scheduler

[Max Zhen]

On 7/16/2026 Thu 08:13, Lizhi Hou wrote:
> amdxdna_cmd_submit() stores current->mm in job->mm without holding any
> reference. aie2_sched_job_run() later access job->mm from the DRM
> scheduler worker thread. With only a raw pointer and no structural
> reference, the mm_struct can be freed before the scheduler runs the job.
> 
> Fix this by calling mmgrab() to hold a structural mm_count reference for
> the lifetime of the job, paired with mmdrop() in every cleanup path.
> 
> Fixes: aac243092b70 ("accel/amdxdna: Add command execution")
> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Reviewed-by: Max Zhen <max.zhen@amd.com>
> ---
>   drivers/accel/amdxdna/amdxdna_ctx.c | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/accel/amdxdna/amdxdna_ctx.c b/drivers/accel/amdxdna/amdxdna_ctx.c
> index bdbd3db12a6c..31a414c3f0d9 100644
> --- a/drivers/accel/amdxdna/amdxdna_ctx.c
> +++ b/drivers/accel/amdxdna/amdxdna_ctx.c
> @@ -577,6 +577,7 @@ void amdxdna_sched_job_cleanup(struct amdxdna_sched_job *job)
>   	amdxdna_arg_bos_put(job);
>   	amdxdna_gem_put_obj(job->cmd_bo);
>   	dma_fence_put(job->fence);
> +	mmdrop(job->mm);
>   }
>   
>   int amdxdna_cmd_submit(struct amdxdna_client *client,
> @@ -642,6 +643,7 @@ int amdxdna_cmd_submit(struct amdxdna_client *client,
>   
>   	job->hwctx = hwctx;
>   	job->mm = current->mm;
> +	mmgrab(job->mm);
>   
>   	job->fence = amdxdna_fence_create(hwctx);
>   	if (!job->fence) {
> @@ -676,6 +678,8 @@ int amdxdna_cmd_submit(struct amdxdna_client *client,
>   cmd_put:
>   	amdxdna_gem_put_obj(job->cmd_bo);
>   free_job:
> +	if (job->mm)
> +		mmdrop(job->mm);
>   	kfree(job);
>   	return ret;
>   }