In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: svm range restore work deadlock when process exit
kfdprocessnotifierrelease flush svmrangerestorework which calls svmrangelistlockandflushwork to flush deferredlist work, but if deferredlist work mmput release the last user, it will call exitmmap -> notifierrelease, it is deadlock with below backtrace.
Move flush svmrangerestorework to kfdprocesswqrelease to avoid deadlock. Then svmrangerestore_work take task->mm ref to avoid mm is gone while validating and mapping ranges to GPU.
Workqueue: events svmrangedeferredlistwork [amdgpu] Call Trace: waitforcompletion+0x94/0x100 _flushwork+0x12a/0x1e0 _cancelworktimer+0x10e/0x190 canceldelayedworksync+0x13/0x20 kfdprocessnotifierrelease+0x98/0x2a0 [amdgpu] _mmunotifierrelease+0x74/0x1f0 exitmmap+0x170/0x200 mmput+0x5d/0x130 svmrangedeferredlistwork+0x104/0x230 [amdgpu] processone_work+0x220/0x3c0