drm/amdgpu: unlock the VM and BO when attaching a KFD BO fails

kfd_mem_attach() locks the page directory and the BO with a drm_exec
transaction on its stack, but leaves through the unwind label without
drm_exec_fini() when locking fails, e.g. when MAP_MEMORY_TO_GPU gets a
signal while the page directory or the BO is busy. Reservations already
acquired then remain locked with their ww_acquire_ctx pointing into the
expired stack frame.

With one thread doing GEM_VA map/unmap on the KFD VM and
another one mapping KFD BOs while getting SIGUSR1 every 20 us:

  BUG: KASAN: stack-out-of-bounds in __ww_mutex_lock.constprop.0+0x34f5/0x3da0
   ww_mutex_lock_interruptible+0x2f/0x150
   drm_exec_lock_obj+0x107/0x2d0 [drm_exec]
   kfd_mem_attach+0x4dd/0x1b60 [amdgpu]

and the process ends up in D state.

Finish the transaction before unwinding.

Fixes: fd1fa48b935f ("drm/amdgpu: lock both VM and BO in amdgpu_gem_object_open")
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 7b885fa27e4b9fa5cbdc64e66fc35872aee296f5)
Cc: stable@vger.kernel.org

0 files changed, 0 insertions, 0 deletions