drm/amdgpu/mes: fix use-after-free issue

From Jack Xiao
39cfce75168c11421d70b8c0c65f6133edccb82a in linux-6.6.y/6.6.33
948255282074d9367e01908b3f5dcf8c10fc9c3d in mainline linux

diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_mes.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_mes.c
index a88eff2..3cb010f 100644 (file)
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_mes.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_mes.c
@@ -1098,6 +1098,7 @@ void amdgpu_mes_remove_ring(struct amdgpu_device *adev,
                return;
 
        amdgpu_mes_remove_hw_queue(adev, ring->hw_queue_id);
+       del_timer_sync(&ring->fence_drv.fallback_timer);
        amdgpu_ring_fini(ring);
        kfree(ring);
 }