tmakin/tegra-linux-noble
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

drm/xe: Free job before xe_exec_queue_put

Browse Source 
BugLink: https://bugs.launchpad.net/bugs/2084005

[ Upstream commit 9e7f30563677fbeff62d368d5d2a5ac7aaa9746a ]

Free job depends on job->vm being valid, the last xe_exec_queue_put can
destroy the VM. Prevent UAF by freeing job before xe_exec_queue_put.

Fixes: dd08ebf6c3 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Signed-off-by: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: Nirmoy Das <nirmoy.das@intel.com>
Reviewed-by: Jagmeet Randhawa <jagmeet.randhawa@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240820202309.1260755-1-matthew.brost@intel.com
(cherry picked from commit 32a42c93b74c8ca6d0915ea3eba21bceff53042f)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[koichiroden: adjusted context due to missing commits:
ad1e331fc451 ("drm/xe: Relax runtime pm protection during execution")
783d6cdc8231 ("drm/xe: Kill xe_device_mem_access_{get*,put}")]
Signed-off-by: Koichiro Den <koichiro.den@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
This commit is contained in:
Matthew Brost
2024-08-20 13:23:09 -07:00
committed by Mehmet Basaran
parent 299e0efcee
commit f07df13f1a
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/gpu/drm/xe/xe_sched_job.c
+2 -1
View File
@@ -188,13 +188,14 @@ void xe_sched_job_destroy(struct kref *ref)
{
struct xe_sched_job *job =
container_of(ref, struct xe_sched_job, refcount);
struct xe_exec_queue *q = job->q;
if (unlikely(job->q->flags & EXEC_QUEUE_FLAG_KERNEL))
xe_device_mem_access_put(job_to_xe(job));
xe_exec_queue_put(job->q);
dma_fence_put(job->fence);
drm_sched_job_cleanup(&job->drm);
job_free(job);
xe_exec_queue_put(q);
}
void xe_sched_job_set_error(struct xe_sched_job *job, int error)