drm/amdgpu: fix use-after-unlock in eviction fence destroy
authorArvind Yadav <Arvind.Yadav@amd.com>
Thu, 15 May 2025 07:14:46 +0000 (12:44 +0530)
committerAlex Deucher <alexander.deucher@amd.com>
Fri, 16 May 2025 17:38:10 +0000 (13:38 -0400)
commit13d0724f0ffe92971ef5a0da819f75c76c01d92e
tree59c08b25168ef64eab19dafbcdbdd5e1a7843a03
parentcc473057bbcc937b8a40792fa8509878ad3d401f
drm/amdgpu: fix use-after-unlock in eviction fence destroy

The eviction fence destroy path incorrectly calls dma_fence_put() on
evf_mgr->ev_fence after releasing the ev_fence_lock. This introduces a
potential use-after-unlock or race because another thread concurrently
modifies evf_mgr->ev_fence.

Fix this by grabbing a local reference to evf_mgr->ev_fence under the
lock and using that for dma_fence_put() after waiting.

Cc: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Sunil Khatri <sunil.khatri@amd.com>
Signed-off-by: Arvind Yadav <Arvind.Yadav@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drivers/gpu/drm/amd/amdgpu/amdgpu_eviction_fence.c