Re: [PATCH V1] accel/amdxdna: Fix use-after-free of mm_struct in job scheduler

[Max Zhen]

On 7/16/2026 Thu 08:13, Lizhi Hou wrote:

amdxdna_cmd_submit() stores current->mm in job->mm without holding any
reference. aie2_sched_job_run() later access job->mm from the DRM
scheduler worker thread. With only a raw pointer and no structural
reference, the mm_struct can be freed before the scheduler runs the job.

Fix this by calling mmgrab() to hold a structural mm_count reference for
the lifetime of the job, paired with mmdrop() in every cleanup path.

Fixes: aac243092b70 ("accel/amdxdna: Add command execution")
Signed-off-by: Lizhi Hou <lizhi....@amd.com>

Reviewed-by: Max Zhen <max.z...@amd.com>

---
  drivers/accel/amdxdna/amdxdna_ctx.c | 4 ++++
  1 file changed, 4 insertions(+)

diff --git a/drivers/accel/amdxdna/amdxdna_ctx.c 
b/drivers/accel/amdxdna/amdxdna_ctx.c
index bdbd3db12a6c..31a414c3f0d9 100644
--- a/drivers/accel/amdxdna/amdxdna_ctx.c
+++ b/drivers/accel/amdxdna/amdxdna_ctx.c
@@ -577,6 +577,7 @@ void amdxdna_sched_job_cleanup(struct amdxdna_sched_job 
*job)
        amdxdna_arg_bos_put(job);
        amdxdna_gem_put_obj(job->cmd_bo);
        dma_fence_put(job->fence);
+       mmdrop(job->mm);
  }

int amdxdna_cmd_submit(struct amdxdna_client *client,

@@ -642,6 +643,7 @@ int amdxdna_cmd_submit(struct amdxdna_client *client,

job->hwctx = hwctx;

        job->mm = current->mm;
+       mmgrab(job->mm);

job->fence = amdxdna_fence_create(hwctx);

        if (!job->fence) {
@@ -676,6 +678,8 @@ int amdxdna_cmd_submit(struct amdxdna_client *client,
  cmd_put:
        amdxdna_gem_put_obj(job->cmd_bo);
  free_job:
+       if (job->mm)
+               mmdrop(job->mm);
        kfree(job);
        return ret;
  }