drm/amdkfd: Fix svm_bo use after free in svm_range_clone

prange->svm_bo stays set after the range drops its reference in
svm_range_vram_node_free(), it is only cleared later by
svm_range_bo_release(). Taking a new reference based on old->svm_bo can
therefore hit a svm_bo with refcount 0 and svm_range_bo_release_async()
pending, leaving the clone with a freed svm_bo.

Use svm_bo_ref_unless_zero() under old->lock to only share the svm_bo if
it is still alive, same as svm_range_validate_svm_bo() does.

A range only holds a svm_bo reference while ttm_res is set, so drop the
reference again if old had already dropped its own. The clone keeps the
svm_bo pointer and stays on svm_bo->range_list, so svm_range_bo_release()
clears the pointer when the svm_bo goes away. The unref must be done
outside old->lock because svm_range_bo_release() takes the lock of every
range on the list, including old.

v3: drop the reference if ttm_res is not set, don't leak it.
v2: use svm_bo_ref_unless_zero instead of checking old->ttm_res, to keep
    sharing the svm_bo when the range dropped its own reference (Felix).

Signed-off-by: Philip Yang <Philip.Yang@amd.com>
Signed-off-by: Mukul Joshi <mukul.joshi@amd.com>
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 0f862d8774161af543fdf6bbc279ba9182c3f8de)

0 files changed, 0 insertions, 0 deletions