linux

mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-07-22 02:17:36 -04:00

Files

Lizhi Hou faebb7ba1a accel/amdxdna: Fix use-after-free of mm_struct in job scheduler

amdxdna_cmd_submit() stores current->mm in job->mm without holding any
reference. aie2_sched_job_run() later access job->mm from the DRM
scheduler worker thread. With only a raw pointer and no structural
reference, the mm_struct can be freed before the scheduler runs the job.

Fix this by calling mmgrab() to hold a structural mm_count reference for
the lifetime of the job, paired with mmdrop() in every cleanup path.

Fixes: aac243092b ("accel/amdxdna: Add command execution")
Reviewed-by: Max Zhen <max.zhen@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260716151305.1595780-1-lizhi.hou@amd.com

2026-07-16 20:05:28 -07:00

amdxdna

accel/amdxdna: Fix use-after-free of mm_struct in job scheduler

2026-07-16 20:05:28 -07:00

ethosu

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

habanalabs

Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses

2026-02-22 08:26:33 -08:00

ivpu

accel/ivpu: Reject firmware log with size smaller than header