xueyuli2 da7ed1c576 amd/virtio: fix bo use-after-free race condition in amdvgpu_bo_free ... In amdvgpu_bo_free(), when the reference count drops to 0, vdrm_flush() is called before removing the bo from the handle_to_vbo hash table. Since vdrm_flush() is a time-consuming operation and is executed outside of the handle_to_vbo_mutex lock, another thread calling amdvgpu_bo_import() can concurrently find this bo in the hash table, increment its refcount, and attempt to use it. Once vdrm_flush() finishes, amdvgpu_bo_free() proceeds to remove the bo and call free(), leaving the importing thread with a dangling pointer, which leads to a use-after-free or double free crash. To fix this race condition, we must remove the bo from the hash table under the lock first. After the bo is safely unlinked and the lock is released, we can then perform the time-consuming vdrm_flush() and the actual memory release. Signed-off-by: zhaqian <zhaqian@amd.com> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/41146>		2026-04-30 08:41:50 +00:00
..
amdgpu_virtio.c	ac/info: get vm_always_valid support through ac_linux_drm	2025-11-20 10:21:47 +00:00
amdgpu_virtio.h	ac/info: get vm_always_valid support through ac_linux_drm	2025-11-20 10:21:47 +00:00
amdgpu_virtio_bo.c	amd/virtio: fix bo use-after-free race condition in amdvgpu_bo_free	2026-04-30 08:41:50 +00:00
amdgpu_virtio_device.c	amd/common/virtio: use hash_table_u64	2026-03-06 11:30:30 +00:00
amdgpu_virtio_private.h	amd/common/virtio: use hash_table_u64	2026-03-06 11:30:30 +00:00
amdgpu_virtio_proto.h