From: jsg <jsg@openbsd.org>
Date: Sat, 15 Jun 2024 03:46:43 +0000 (+0000)
Subject: drm/amdgpu/mes: fix use-after-free issue
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=57d3fb695948734d71238c81b7ecb819570364c0;p=openbsd

drm/amdgpu/mes: fix use-after-free issue

From Jack Xiao
39cfce75168c11421d70b8c0c65f6133edccb82a in linux-6.6.y/6.6.33
948255282074d9367e01908b3f5dcf8c10fc9c3d in mainline linux
---

diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_mes.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_mes.c
index a88eff2f53b..3cb010f1f5e 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_mes.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_mes.c
@@ -1098,6 +1098,7 @@ void amdgpu_mes_remove_ring(struct amdgpu_device *adev,
 		return;
 
 	amdgpu_mes_remove_hw_queue(adev, ring->hw_queue_id);
+	del_timer_sync(&ring->fence_drv.fallback_timer);
 	amdgpu_ring_fini(ring);
 	kfree(ring);
 }