drm/amdkfd: Fix a race condition of vram buffer unref in svm code

prange->svm_bo unref can happen in both mmu callback and a callback after
migrate to system ram. Both are async call in different tasks. Sync svm_bo
unref operation to avoid random "use-after-free".

Signed-off-by: Xiaogang Chen <xiaogang.chen@amd.com>
Reviewed-by: Philip Yang <Philip.Yang@amd.com>
Reviewed-by: Jesse Zhang <Jesse.Zhang@amd.com>
Tested-by: Jesse Zhang <Jesse.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
index 58cca80589ae3e344a89c1db483548e4d62babff..1d5f91678fa99a1869568b3fb07e05ebecf565f7 100644 (file)
--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
@@ -637,8 +637,15 @@ create_bo_failed:
 
 void svm_range_vram_node_free(struct svm_range *prange)
 {
-       svm_range_bo_unref(prange->svm_bo);
-       prange->ttm_res = NULL;
+       /* serialize prange->svm_bo unref */
+       mutex_lock(&prange->lock);
+       /* prange->svm_bo has not been unref */
+       if (prange->ttm_res) {
+               prange->ttm_res = NULL;
+               mutex_unlock(&prange->lock);
+               svm_range_bo_unref(prange->svm_bo);
+       } else
+               mutex_unlock(&prange->lock);
 }
 
 struct kfd_node *