dma-buf: Fix one use-after-free of fence

xinhui pan · ChristianKoenigAMD · commit 7c1aeba7bb97 · 2022-07-07T10:24:59.000+02:00
Need get the new fence when we replace the old one. Fixes: 047a1b8 ("dma-buf & drm/amdgpu: remove dma_resv workaround") Signed-off-by: xinhui pan <xinhui.pan@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Link: https://patchwork.freedesktop.org/patch/msgid/20220707080241.20060-1-xinhui.pan@amd.com Signed-off-by: Christian König <christian.koenig@amd.com>
diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
@@ -343,7 +343,7 @@ void dma_resv_replace_fences(struct dma_resv *obj, uint64_t context,
 		if (old->context != context)
 			continue;
 
-		dma_resv_list_set(list, i, replacement, usage);
+		dma_resv_list_set(list, i, dma_fence_get(replacement), usage);
 		dma_fence_put(old);
 	}
 }

Original file line number	Diff line number	Diff line change
`@@ -343,7 +343,7 @@ void dma_resv_replace_fences(struct dma_resv *obj, uint64_t context,`
`343`	`343`	`if (old->context != context)`
`344`	`344`	`continue;`
`345`	`345`
`346`		`- dma_resv_list_set(list, i, replacement, usage);`
	`346`	`+ dma_resv_list_set(list, i, dma_fence_get(replacement), usage);`
`347`	`347`	`dma_fence_put(old);`
`348`	`348`	`}`
`349`	`349`	`}`