On 9/2/2026 Wed 11:09, Lizhi Hou wrote:
Accessing abo->client in amdxdna_gem_del_bo_usage() may result in a
use-after-free when the BO is imported via flink.
Disable flink import by verifing that filp->driver_priv matches the client
stored in abo->client before accessing the client.
Fixes: 3cc5d7a59519 ("accel/amdxdna: Add carveout memory support for non-IOMMU
systems")
Signed-off-by: Lizhi Hou <[email protected]>
Reviewed-by: Max Zhen <[email protected]>
---
drivers/accel/amdxdna/amdxdna_gem.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/accel/amdxdna/amdxdna_gem.c
b/drivers/accel/amdxdna/amdxdna_gem.c
index 476649685e5a..1353393194e2 100644
--- a/drivers/accel/amdxdna/amdxdna_gem.c
+++ b/drivers/accel/amdxdna/amdxdna_gem.c
@@ -697,6 +697,8 @@ static int amdxdna_gem_obj_open(struct drm_gem_object
*gobj, struct drm_file *fi
int ret;
guard(mutex)(&abo->lock);
+ if (abo->open_ref > 0 && filp->driver_priv != abo->client)
+ return -EPERM;
abo->open_ref++;
if (abo->open_ref > 1)
return 0;
