[AMD Official Use Only - AMD Internal Distribution Only]

Hi Xiaogang,

I think this is a security vulnerability, the race could be intentionally 
triggered, so it doesn't matter how thunk opens render nodes, the kernel should 
handle this case safely.

Alysa

-----Original Message-----
From: Chen, Xiaogang <[email protected]>
Sent: Thursday, February 5, 2026 1:09 PM
To: Liu, Alysa <[email protected]>; [email protected]
Cc: Deucher, Alexander <[email protected]>; Kasiviswanathan, Harish 
<[email protected]>
Subject: Re: [PATCH] drm/amdgpu: Fix use-after-free race in VM acquire


On 2/5/2026 10:28 AM, [email protected] wrote:
> Replace non-atomic vm->process_info assignment with cmpxchg() to
> prevent race when parent/child processes sharing a drm_file both try
> to acquire the same VM after fork().

I wonder how parent/child processes can share same drm file? The child process 
should close render node after fork/exec, then create its own gpu vm. Thunk 
open render node with O_CLOEXEC.

Regards

Xiaogang

> Signed-off-by: [email protected] <[email protected]>
> ---
>   drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 6 +++++-
>   1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
> b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
> index 00ea69baa126..f7b2358a0303 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
> @@ -1432,7 +1432,10 @@ static int init_kfd_vm(struct amdgpu_vm *vm, void 
> **process_info,
>               *process_info = info;
>       }
>
> -     vm->process_info = *process_info;
> +     if (cmpxchg(&vm->process_info, NULL, *process_info) != NULL) {
> +             ret = -EINVAL;
> +             goto already_acquired;
> +     }
>
>       /* Validate page directory and attach eviction fence */
>       ret = amdgpu_bo_reserve(vm->root.bo, true); @@ -1472,6 +1475,7 @@
> static int init_kfd_vm(struct amdgpu_vm *vm, void **process_info,
>       amdgpu_bo_unreserve(vm->root.bo);
>   reserve_pd_fail:
>       vm->process_info = NULL;
> +already_acquired:
>       if (info) {
>               dma_fence_put(&info->eviction_fence->base);
>               *process_info = NULL;

Reply via email to