[PATCH V2 3/3] accel/amdxdna: Fix amdxdna_client race in amdxdna_show_fdinfo()

[Lizhi Hou]

amdxdna_show_fdinfo() can be called after drm_dev_unplug() during device
removal. In that case, the show_fdinfo path may access amdxdna_client
after it has been freed, leading to a use-after-free.

Guard the show_fdinfo path with drm_dev_enter()/drm_dev_exit() and return
if the device is already unplugged.

Fixes: e0169d0c690f ("accel/amdxdna: Expose per-client BO memory usage via 
fdinfo")
Signed-off-by: Lizhi Hou <lizhi....@amd.com>
---
 drivers/accel/amdxdna/amdxdna_pci_drv.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/accel/amdxdna/amdxdna_pci_drv.c 
b/drivers/accel/amdxdna/amdxdna_pci_drv.c
index c18ddad9f645..e6b541db3898 100644
--- a/drivers/accel/amdxdna/amdxdna_pci_drv.c
+++ b/drivers/accel/amdxdna/amdxdna_pci_drv.c
@@ -296,6 +296,10 @@ static void amdxdna_show_fdinfo(struct drm_printer *p, 
struct drm_file *filp)
        struct amdxdna_client *client = filp->driver_priv;
        size_t heap_usage, external_usage, internal_usage;
        char *drv_name = filp->minor->dev->driver->name;
+       int idx;
+
+       if (!drm_dev_enter(filp->minor->dev, &idx))
+               return;
 
        mutex_lock(&client->mm_lock);
 
@@ -320,6 +324,8 @@ static void amdxdna_show_fdinfo(struct drm_printer *p, 
struct drm_file *filp)
         * drm-shared-memory counts BO shared with other processes/devices.
         */
        drm_show_memory_stats(p, filp);
+
+       drm_dev_exit(idx);
 }
 
 static const struct file_operations amdxdna_fops = {
-- 
2.34.1