All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] drm/xe/tracing: Fix a potential TP_printk UAF
@ 2024-12-23 13:42 Thomas Hellström
  2024-12-23 13:48 ` ✓ CI.Patch_applied: success for " Patchwork
                   ` (9 more replies)
  0 siblings, 10 replies; 17+ messages in thread
From: Thomas Hellström @ 2024-12-23 13:42 UTC (permalink / raw)
  To: intel-xe
  Cc: Thomas Hellström, Gustavo Sousa, Lucas De Marchi,
	Radhakrishna Sripada, Matt Roper, Rodrigo Vivi, stable

The commit
afd2627f727b ("tracing: Check "%s" dereference via the field and not the TP_printk format")
exposes potential UAFs in the xe_bo_move trace event.

Fix those by avoiding dereferencing the
xe_mem_type_to_name[] array at TP_printk time.

Since some code refactoring has taken place, explicit backporting may
be needed for kernels older than 6.10.

Fixes: e46d3f813abd ("drm/xe/trace: Extract bo, vm, vma traces")
Cc: Gustavo Sousa <gustavo.sousa@intel.com>
Cc: Lucas De Marchi <lucas.demarchi@intel.com>
Cc: Radhakrishna Sripada <radhakrishna.sripada@intel.com>
Cc: Matt Roper <matthew.d.roper@intel.com>
Cc: "Thomas Hellström" <thomas.hellstrom@linux.intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: intel-xe@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v6.11+
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
---
 drivers/gpu/drm/xe/xe_trace_bo.h | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/xe/xe_trace_bo.h b/drivers/gpu/drm/xe/xe_trace_bo.h
index 1762dd30ba6d..ea50fee50c7d 100644
--- a/drivers/gpu/drm/xe/xe_trace_bo.h
+++ b/drivers/gpu/drm/xe/xe_trace_bo.h
@@ -60,8 +60,8 @@ TRACE_EVENT(xe_bo_move,
 	    TP_STRUCT__entry(
 		     __field(struct xe_bo *, bo)
 		     __field(size_t, size)
-		     __field(u32, new_placement)
-		     __field(u32, old_placement)
+		     __string(new_placement_name, xe_mem_type_to_name[new_placement])
+		     __string(old_placement_name, xe_mem_type_to_name[old_placement])
 		     __string(device_id, __dev_name_bo(bo))
 		     __field(bool, move_lacks_source)
 			),
@@ -69,15 +69,15 @@ TRACE_EVENT(xe_bo_move,
 	    TP_fast_assign(
 		   __entry->bo      = bo;
 		   __entry->size = bo->size;
-		   __entry->new_placement = new_placement;
-		   __entry->old_placement = old_placement;
+		   __assign_str(new_placement_name);
+		   __assign_str(old_placement_name);
 		   __assign_str(device_id);
 		   __entry->move_lacks_source = move_lacks_source;
 		   ),
 	    TP_printk("move_lacks_source:%s, migrate object %p [size %zu] from %s to %s device_id:%s",
 		      __entry->move_lacks_source ? "yes" : "no", __entry->bo, __entry->size,
-		      xe_mem_type_to_name[__entry->old_placement],
-		      xe_mem_type_to_name[__entry->new_placement], __get_str(device_id))
+		      __get_str(old_placement_name),
+		      __get_str(new_placement_name), __get_str(device_id))
 );
 
 DECLARE_EVENT_CLASS(xe_vma,
-- 
2.47.1


^ permalink raw reply related	[flat|nested] 17+ messages in thread
end of thread, other threads:[~2025-01-01 13:25 UTC | newest]

Thread overview: 17+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-12-23 13:42 [PATCH] drm/xe/tracing: Fix a potential TP_printk UAF Thomas Hellström
2024-12-23 13:48 ` ✓ CI.Patch_applied: success for " Patchwork
2024-12-23 13:49 ` ✗ CI.checkpatch: warning " Patchwork
2024-12-23 13:50 ` ✓ CI.KUnit: success " Patchwork
2024-12-23 14:08 ` ✓ CI.Build: " Patchwork
2024-12-23 14:10 ` ✓ CI.Hooks: " Patchwork
2024-12-23 14:12 ` ✓ CI.checksparse: " Patchwork
2024-12-23 15:44 ` [PATCH] " Matthew Brost
2024-12-23 16:33   ` Thomas Hellström
2025-01-01 13:25     ` Lucas De Marchi
2024-12-23 15:44 ` Cavitt, Jonathan
2024-12-23 15:56   ` Thomas Hellström
2024-12-23 17:04     ` Cavitt, Jonathan
2024-12-23 17:13       ` Thomas Hellström
2024-12-23 16:35 ` ✗ Xe.CI.Full: failure for " Patchwork
2024-12-23 17:08   ` Thomas Hellström
2024-12-24  7:18 ` ✗ CI.Patch_applied: failure for drm/xe/tracing: Fix a potential TP_printk UAF (rev2) Patchwork

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.