[PATCH] drm/amdgpu: Fix potential fence use-after-free v2

[Alex Deucher]

On Wed, Jun 28, 2023 at 9:45 AM Christian König
<ckoenig.leichtzumerken at gmail.com> wrote:
>
> From: shanzhulig <shanzhulig at gmail.com>
>
> fence Decrements the reference count before exiting.
> Avoid Race Vulnerabilities for fence use-after-free.
>
> v2 (chk): actually fix the use after free and not just move it.
>
> Signed-off-by: shanzhulig <shanzhulig at email.com>
> Signed-off-by: Christian König <christian.koenig at amd.com>

Reviewed-by: Alex Deucher <alexander.deucher at amd.com>

> ---
>  drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> index 2eb2c66843a8..71a9c4ab905f 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> @@ -1624,15 +1624,15 @@ static int amdgpu_cs_wait_all_fences(struct amdgpu_device *adev,
>                         continue;
>
>                 r = dma_fence_wait_timeout(fence, true, timeout);
> +               if (r > 0 && fence->error)
> +                       r = fence->error;
> +
>                 dma_fence_put(fence);
>                 if (r < 0)
>                         return r;
>
>                 if (r == 0)
>                         break;
> -
> -               if (fence->error)
> -                       return fence->error;
>         }
>
>         memset(wait, 0, sizeof(*wait));
> --
> 2.34.1
>