github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-28 17:13:52 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

drm/xe/migrate: prevent potential UAF

Browse Source 
If we hit the error path, the previous fence (if there is one) has
already been put() prior to this, so doing a fence_wait could lead to
UAF. Tweak the flow to do to the put() until after we do the wait.

Fixes: 270172f64b ("drm/xe: Update xe_ttm_access_memory to use GPU for non-visible access")
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Cc: Maciej Patelczyk <maciej.patelczyk@intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: Stuart Summers <stuart.summers@intel.com>
Link: https://lore.kernel.org/r/20250731093807.207572-8-matthew.auld@intel.com
This commit is contained in:
Matthew Auld 2025-07-31 10:38:11 +01:00
parent 8c2d61e0e9
commit 9b7ca35ed2
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/gpu/drm/xe/xe_migrate.c
View File

@ -2090,9 +2090,6 @@ int xe_migrate_access_memory(struct xe_migrate *m, struct xe_bo *bo,
current_bytes = min_t(int, current_bytes, S16_MAX * pitch);
}
if (fence)
dma_fence_put(fence);
__fence = xe_migrate_vram(m, current_bytes,
(unsigned long)buf & ~PAGE_MASK,
&pagemap_addr[current_page],
@ -2100,11 +2097,15 @@ int xe_migrate_access_memory(struct xe_migrate *m, struct xe_bo *bo,
XE_MIGRATE_COPY_TO_VRAM :
XE_MIGRATE_COPY_TO_SRAM);
if (IS_ERR(__fence)) {
if (fence)
if (fence) {
dma_fence_wait(fence, false);
dma_fence_put(fence);
}
fence = __fence;
goto out_err;
}
dma_fence_put(fence);
fence = __fence;
buf += current_bytes;