From aaecffa50b4c06962164db64562cd6689a568122 Mon Sep 17 00:00:00 2001 From: Victor Zhang <111778801+victzhan@users.noreply.github.com> Date: Tue, 9 Dec 2025 11:38:45 -0500 Subject: [PATCH] SWDEV-568847 - prevent UAF when registering callbacks on completed events (#2066) * SWDEV-568847 - prevent UAF when registering callbacks on completed events * cache the status() of event earlier * Update command.cpp * revert cl_event.cpp * Update cl_event.cpp --------- Co-authored-by: cadolphe-amd --- projects/clr/opencl/amdocl/cl_event.cpp | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/projects/clr/opencl/amdocl/cl_event.cpp b/projects/clr/opencl/amdocl/cl_event.cpp index 1dd1823d04..e1263ae111 100644 --- a/projects/clr/opencl/amdocl/cl_event.cpp +++ b/projects/clr/opencl/amdocl/cl_event.cpp @@ -377,11 +377,17 @@ RUNTIME_ENTRY(cl_int, clSetEventCallback, return CL_INVALID_VALUE; } - if (!as_amd(event)->setCallback(command_exec_callback_type, pfn_notify, user_data)) { + amd::Event* ev = as_amd(event); + ev->retain(); + + if (!ev->setCallback(command_exec_callback_type, pfn_notify, user_data)) { + ev->release(); return CL_OUT_OF_HOST_MEMORY; } - - as_amd(event)->notifyCmdQueue(); + if (ev->status() > CL_COMPLETE) { + ev->notifyCmdQueue(); + } + ev->release(); return CL_SUCCESS; }