Re: [PATCH V1] accel/amdxdna: Fix potential amdxdna_umap lifetime race

[Lizhi Hou]

Applied to drm-misc-fixes

On 7/7/26 08:35, Max Zhen wrote:

On 7/6/2026 Mon 15:12, Lizhi Hou wrote:

amdxdna_umap_release() calls the blocking mmu_interval_notifier_remove()
before removing the object from abo->mem.umap_list. If
aie2_populate_range() runs concurrently, it may obtain a reference to an

amdxdna_umap that is being released, leading to a potential use-after-free.

Use refcount_inc_not_zero() in aie2_populate_range() when acquiring a
reference. If the reference count has already dropped to zero, release
is in progress and the entry is skipped.

Fixes: e486147c912f ("accel/amdxdna: Add BO import and export")
Signed-off-by: Lizhi Hou <lizhi....@amd.com>

Reviewed-by: Max Zhen <max.z...@amd.com>

The patch description mentioned refcount_inc_not_zero(), but the real fix calls kref_get_unless_zero() which is a wrapper of refcount_inc_not_zero(). It might be better to fix the description to match the fix in the code.

Thanks,
Max

---
  drivers/accel/amdxdna/aie2_ctx.c | 4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c

index 408ff7e2a272..7bf635634e64 100644
--- a/drivers/accel/amdxdna/aie2_ctx.c
+++ b/drivers/accel/amdxdna/aie2_ctx.c

@@ -1039,7 +1039,7 @@ static int aie2_populate_range(struct amdxdna_gem_obj *abo)

      found = false;
      down_write(&xdna->notifier_lock);
      list_for_each_entry(mapp, &abo->mem.umap_list, node) {
-        if (mapp->invalid) {
+        if (mapp->invalid && kref_get_unless_zero(&mapp->refcnt)) {
              found = true;
              break;
          }

@@ -1050,7 +1050,7 @@ static int aie2_populate_range(struct amdxdna_gem_obj *abo)

          up_write(&xdna->notifier_lock);
          return 0;
      }
-    kref_get(&mapp->refcnt);
+
      up_write(&xdna->notifier_lock);
        mm = mapp->notifier.mm;