amdxdna_gem_dmabuf_mmap() takes a reference with drm_gem_object_get()
and, on the vm_insert_pages() failure path, jumps to close_vma which
calls vma->vm_ops->close(). For a shmem GEM object vm_ops is
drm_gem_shmem_vm_ops, whose .close (drm_gem_shmem_vm_close ->
drm_gem_vm_close) already drops that reference. Execution then falls
through to put_obj and drops it a second time.
This underflows the GEM object refcount and frees it prematurely while
the dma-buf still references it, leading to a use-after-free.
Return directly after vm_ops->close() instead of falling through to the
extra drm_gem_object_put(), matching the sibling amdxdna_insert_pages()
error path.
Fixes: e486147c912f ("accel/amdxdna: Add BO import and export")
Cc: [email protected]
Signed-off-by: Jhonraushan <[email protected]>
---
drivers/accel/amdxdna/amdxdna_gem.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/accel/amdxdna/amdxdna_gem.c
b/drivers/accel/amdxdna/amdxdna_gem.c
index 891112c2cddf..3ac8c345b25b 100644
--- a/drivers/accel/amdxdna/amdxdna_gem.c
+++ b/drivers/accel/amdxdna/amdxdna_gem.c
@@ -526,7 +526,12 @@ static int amdxdna_gem_dmabuf_mmap(struct dma_buf
*dma_buf, struct vm_area_struc
return 0;
close_vma:
+ /* vm_ops->close() drops the reference taken by drm_gem_object_get()
+ * above, so return directly instead of falling through to put_obj
+ * and dropping it a second time.
+ */
vma->vm_ops->close(vma);
+ return ret;
put_obj:
drm_gem_object_put(gobj);
return ret;
--
2.43.0
