projects
/
linux-2.6-microblaze.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
6d796c5
)
drm/i915: Avoid potential vm use-after-free
author
Rob Clark
<robdclark@chromium.org>
Thu, 19 Jan 2023 17:32:58 +0000
(09:32 -0800)
committer
Rodrigo Vivi
<rodrigo.vivi@intel.com>
Mon, 30 Jan 2023 20:48:08 +0000
(15:48 -0500)
Adding the vm to the vm_xa table makes it visible to userspace, which
could try to race with us to close the vm. So we need to take our extra
reference before putting it in the table.
Signed-off-by: Rob Clark <robdclark@chromium.org>
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
Fixes:
9ec8795e7d91
("drm/i915: Drop __rcu from gem_context->vm")
Cc: <stable@vger.kernel.org> # v5.16+
Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Link:
https://patchwork.freedesktop.org/patch/msgid/20230119173321.2825472-1-robdclark@gmail.com
(cherry picked from commit
99343c46d4e2b34c285d3d5f68ff04274c2f9fb4
)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
drivers/gpu/drm/i915/gem/i915_gem_context.c
patch
|
blob
|
history
diff --git
a/drivers/gpu/drm/i915/gem/i915_gem_context.c
b/drivers/gpu/drm/i915/gem/i915_gem_context.c
index
6250de9
..
e4b78ab
100644
(file)
--- a/
drivers/gpu/drm/i915/gem/i915_gem_context.c
+++ b/
drivers/gpu/drm/i915/gem/i915_gem_context.c
@@
-1861,11
+1861,19
@@
static int get_ppgtt(struct drm_i915_file_private *file_priv,
vm = ctx->vm;
GEM_BUG_ON(!vm);
+ /*
+ * Get a reference for the allocated handle. Once the handle is
+ * visible in the vm_xa table, userspace could try to close it
+ * from under our feet, so we need to hold the extra reference
+ * first.
+ */
+ i915_vm_get(vm);
+
err = xa_alloc(&file_priv->vm_xa, &id, vm, xa_limit_32b, GFP_KERNEL);
- if (err)
+ if (err) {
+ i915_vm_put(vm);
return err;
-
- i915_vm_get(vm);
+ }
GEM_BUG_ON(id == 0); /* reserved for invalid/unassigned ppgtt */
args->value = id;