From f07df13f1a2063b5f3296d80bf81b6bc3856cfd0 Mon Sep 17 00:00:00 2001 From: Matthew Brost Date: Tue, 20 Aug 2024 13:23:09 -0700 Subject: [PATCH] drm/xe: Free job before xe_exec_queue_put BugLink: https://bugs.launchpad.net/bugs/2084005 [ Upstream commit 9e7f30563677fbeff62d368d5d2a5ac7aaa9746a ] Free job depends on job->vm being valid, the last xe_exec_queue_put can destroy the VM. Prevent UAF by freeing job before xe_exec_queue_put. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Matthew Brost Reviewed-by: Nirmoy Das Reviewed-by: Jagmeet Randhawa Link: https://patchwork.freedesktop.org/patch/msgid/20240820202309.1260755-1-matthew.brost@intel.com (cherry picked from commit 32a42c93b74c8ca6d0915ea3eba21bceff53042f) Signed-off-by: Rodrigo Vivi Signed-off-by: Sasha Levin [koichiroden: adjusted context due to missing commits: ad1e331fc451 ("drm/xe: Relax runtime pm protection during execution") 783d6cdc8231 ("drm/xe: Kill xe_device_mem_access_{get*,put}")] Signed-off-by: Koichiro Den Signed-off-by: Stefan Bader --- drivers/gpu/drm/xe/xe_sched_job.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/xe/xe_sched_job.c b/drivers/gpu/drm/xe/xe_sched_job.c index d07b9ee0eaa5..43c8ca2c7bc4 100644 --- a/drivers/gpu/drm/xe/xe_sched_job.c +++ b/drivers/gpu/drm/xe/xe_sched_job.c @@ -188,13 +188,14 @@ void xe_sched_job_destroy(struct kref *ref) { struct xe_sched_job *job = container_of(ref, struct xe_sched_job, refcount); + struct xe_exec_queue *q = job->q; if (unlikely(job->q->flags & EXEC_QUEUE_FLAG_KERNEL)) xe_device_mem_access_put(job_to_xe(job)); - xe_exec_queue_put(job->q); dma_fence_put(job->fence); drm_sched_job_cleanup(&job->drm); job_free(job); + xe_exec_queue_put(q); } void xe_sched_job_set_error(struct xe_sched_job *job, int error)