[PATCH 0/2] drm/amdgpu: fix use-after-free in userq signal/wait IOCTLs

[Chenyuan Mi]

Both amdgpu_userq_wait_ioctl() and amdgpu_userq_signal_ioctl()
access user queue objects obtained from xa_load() without holding
userq_mutex. A concurrent AMDGPU_USERQ_OP_FREE can destroy and
kfree the queue in this window, leading to use-after-free.

The two bugs have different origins:

- Patch 1 fixes a wait-path regression introduced by commit
  4b27406380b0 ("drm/amdgpu: Add queue id support to the user queue
  wait IOCTL"), which removed the indirect fence_drv_xa_ptr model
  and its NULL-check safety net from commit ed5fdc1fc282
  ("drm/amdgpu: Fix the use-after-free issue in wait IOCTL").

- Patch 2 fixes a similar pre-existing lifetime bug in the signal
  path, present since commit a292fdecd728 ("drm/amdgpu: Implement
  userqueue signal/wait IOCTL").

Patch 1 adds explicit userq_mutex coverage around the xa_load and
subsequent fence_drv_xa operations in the wait path.

Patch 2 moves the ensure_ev_fence call (which acquires
userq_mutex) before xa_load in the signal path, so that the queue
lookup and all subsequent accesses are covered by the same lock.

Chenyuan Mi (2):
  drm/amdgpu: protect waitq access with userq_mutex in wait IOCTL
  drm/amdgpu: protect queue access in signal IOCTL

 .../gpu/drm/amd/amdgpu/amdgpu_userq_fence.c   | 25 +++++++++++++------
 1 file changed, 18 insertions(+), 7 deletions(-)

--
2.53.0