[PATCH] drm/amdgpu: Fix stub fence refcount underflow

[PATCH] drm/amdgpu: Fix stub fence refcount underflow

[Felix Kuehling]

Don't drop the stub fence reference after installing it as a replacement
for the eviction fence. dma_resv_replace_fences doesn't take another
reference to the fence, so it takes ownership of the reference passed
in by us.

Fixes: 548e7432dc2d ("dma-buf: add dma_resv_replace_fences v2")
CC: Christian König <christian.koenig@amd.com>
Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
index 87a3a3ae9448..a6c7dcd8c345 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
@@ -294,7 +294,6 @@ static int amdgpu_amdkfd_remove_eviction_fence(struct amdgpu_bo *bo,
 	replacement = dma_fence_get_stub();
 	dma_resv_replace_fences(bo->tbo.base.resv, ef->base.context,
 				replacement, DMA_RESV_USAGE_READ);
-	dma_fence_put(replacement);
 	return 0;
 }
 
-- 
2.32.0

Re: [PATCH] drm/amdgpu: Fix stub fence refcount underflow

[Felix Kuehling]

Am 2022-07-27 um 23:52 schrieb Alex Deucher:
> On Wed, Jul 27, 2022 at 7:08 PM Felix Kuehling <Felix.Kuehling@amd.com> wrote:
>> Don't drop the stub fence reference after installing it as a replacement
>> for the eviction fence. dma_resv_replace_fences doesn't take another
>> reference to the fence, so it takes ownership of the reference passed
>> in by us.
>>
>> Fixes: 548e7432dc2d ("dma-buf: add dma_resv_replace_fences v2")
>> CC: Christian König <christian.koenig@amd.com>
>> Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
> Acked-by: Alex Deucher <alexander.deucher@amd.com>

This patch is the wrong solution. Xinhui added a dma_fence_get in 
dma_resv_replace_fences in his patch "dma-buf: Fix one use-after-free of 
fence". So this patch is not needed any more.

Regards,
   Felix


>> ---
>>   drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 1 -
>>   1 file changed, 1 deletion(-)
>>
>> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
>> index 87a3a3ae9448..a6c7dcd8c345 100644
>> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
>> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
>> @@ -294,7 +294,6 @@ static int amdgpu_amdkfd_remove_eviction_fence(struct amdgpu_bo *bo,
>>          replacement = dma_fence_get_stub();
>>          dma_resv_replace_fences(bo->tbo.base.resv, ef->base.context,
>>                                  replacement, DMA_RESV_USAGE_READ);
>> -       dma_fence_put(replacement);
>>          return 0;
>>   }
>>
>> --
>> 2.32.0
>>