* [Intel-gfx] [PATCH] drm/i915: Prevent potential UAF in engine_init_common
@ 2023-10-11 11:54 ` Nirmoy Das
0 siblings, 0 replies; 10+ messages in thread
From: Nirmoy Das @ 2023-10-11 11:54 UTC (permalink / raw)
To: intel-gfx; +Cc: dri-devel, Nirmoy Das
If measure_breadcrumb_dw() returns an error and bce isn't created,
this commit ensures that intel_engine_destroy_pinned_context()
is not called with a NULL bce.
Fixes: b35274993680 ("drm/i915: Create a kernel context for GGTT updates")
Cc: Oak Zeng <oak.zeng@intel.com>
Cc: Andi Shyti <andi.shyti@linux.intel.com>
Signed-off-by: Nirmoy Das <nirmoy.das@intel.com>
---
drivers/gpu/drm/i915/gt/intel_engine_cs.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
index 179d9546865b..4a11219e560e 100644
--- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c
+++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
@@ -1491,7 +1491,8 @@ static int engine_init_common(struct intel_engine_cs *engine)
return 0;
err_bce_context:
- intel_engine_destroy_pinned_context(bce);
+ if (bce)
+ intel_engine_destroy_pinned_context(bce);
err_ce_context:
intel_engine_destroy_pinned_context(ce);
return ret;
--
2.41.0
^ permalink raw reply related [flat|nested] 10+ messages in thread
* [PATCH] drm/i915: Prevent potential UAF in engine_init_common
@ 2023-10-11 11:54 ` Nirmoy Das
0 siblings, 0 replies; 10+ messages in thread
From: Nirmoy Das @ 2023-10-11 11:54 UTC (permalink / raw)
To: intel-gfx; +Cc: Andi Shyti, Oak Zeng, dri-devel, Nirmoy Das
If measure_breadcrumb_dw() returns an error and bce isn't created,
this commit ensures that intel_engine_destroy_pinned_context()
is not called with a NULL bce.
Fixes: b35274993680 ("drm/i915: Create a kernel context for GGTT updates")
Cc: Oak Zeng <oak.zeng@intel.com>
Cc: Andi Shyti <andi.shyti@linux.intel.com>
Signed-off-by: Nirmoy Das <nirmoy.das@intel.com>
---
drivers/gpu/drm/i915/gt/intel_engine_cs.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
index 179d9546865b..4a11219e560e 100644
--- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c
+++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
@@ -1491,7 +1491,8 @@ static int engine_init_common(struct intel_engine_cs *engine)
return 0;
err_bce_context:
- intel_engine_destroy_pinned_context(bce);
+ if (bce)
+ intel_engine_destroy_pinned_context(bce);
err_ce_context:
intel_engine_destroy_pinned_context(ce);
return ret;
--
2.41.0
^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: [Intel-gfx] [PATCH] drm/i915: Prevent potential UAF in engine_init_common
2023-10-11 11:54 ` Nirmoy Das
@ 2023-10-11 12:20 ` Jani Nikula
-1 siblings, 0 replies; 10+ messages in thread
From: Jani Nikula @ 2023-10-11 12:20 UTC (permalink / raw)
To: Nirmoy Das, intel-gfx; +Cc: dri-devel, Nirmoy Das
On Wed, 11 Oct 2023, Nirmoy Das <nirmoy.das@intel.com> wrote:
> If measure_breadcrumb_dw() returns an error and bce isn't created,
> this commit ensures that intel_engine_destroy_pinned_context()
> is not called with a NULL bce.
So it's a potential NULL pointer dereference, not use after free like
the subject says. Please fix the subject.
BR,
Jani.
>
> Fixes: b35274993680 ("drm/i915: Create a kernel context for GGTT updates")
> Cc: Oak Zeng <oak.zeng@intel.com>
> Cc: Andi Shyti <andi.shyti@linux.intel.com>
> Signed-off-by: Nirmoy Das <nirmoy.das@intel.com>
> ---
> drivers/gpu/drm/i915/gt/intel_engine_cs.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
> index 179d9546865b..4a11219e560e 100644
> --- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c
> +++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
> @@ -1491,7 +1491,8 @@ static int engine_init_common(struct intel_engine_cs *engine)
> return 0;
>
> err_bce_context:
> - intel_engine_destroy_pinned_context(bce);
> + if (bce)
> + intel_engine_destroy_pinned_context(bce);
> err_ce_context:
> intel_engine_destroy_pinned_context(ce);
> return ret;
--
Jani Nikula, Intel
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] drm/i915: Prevent potential UAF in engine_init_common
@ 2023-10-11 12:20 ` Jani Nikula
0 siblings, 0 replies; 10+ messages in thread
From: Jani Nikula @ 2023-10-11 12:20 UTC (permalink / raw)
To: Nirmoy Das, intel-gfx; +Cc: dri-devel, Oak Zeng, Andi Shyti, Nirmoy Das
On Wed, 11 Oct 2023, Nirmoy Das <nirmoy.das@intel.com> wrote:
> If measure_breadcrumb_dw() returns an error and bce isn't created,
> this commit ensures that intel_engine_destroy_pinned_context()
> is not called with a NULL bce.
So it's a potential NULL pointer dereference, not use after free like
the subject says. Please fix the subject.
BR,
Jani.
>
> Fixes: b35274993680 ("drm/i915: Create a kernel context for GGTT updates")
> Cc: Oak Zeng <oak.zeng@intel.com>
> Cc: Andi Shyti <andi.shyti@linux.intel.com>
> Signed-off-by: Nirmoy Das <nirmoy.das@intel.com>
> ---
> drivers/gpu/drm/i915/gt/intel_engine_cs.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
> index 179d9546865b..4a11219e560e 100644
> --- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c
> +++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
> @@ -1491,7 +1491,8 @@ static int engine_init_common(struct intel_engine_cs *engine)
> return 0;
>
> err_bce_context:
> - intel_engine_destroy_pinned_context(bce);
> + if (bce)
> + intel_engine_destroy_pinned_context(bce);
> err_ce_context:
> intel_engine_destroy_pinned_context(ce);
> return ret;
--
Jani Nikula, Intel
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [Intel-gfx] [PATCH] drm/i915: Prevent potential UAF in engine_init_common
2023-10-11 12:20 ` Jani Nikula
@ 2023-10-11 12:22 ` Nirmoy Das
-1 siblings, 0 replies; 10+ messages in thread
From: Nirmoy Das @ 2023-10-11 12:22 UTC (permalink / raw)
To: Jani Nikula, intel-gfx; +Cc: dri-devel
On 10/11/2023 2:20 PM, Jani Nikula wrote:
> On Wed, 11 Oct 2023, Nirmoy Das <nirmoy.das@intel.com> wrote:
>> If measure_breadcrumb_dw() returns an error and bce isn't created,
>> this commit ensures that intel_engine_destroy_pinned_context()
>> is not called with a NULL bce.
> So it's a potential NULL pointer dereference, not use after free like
> the subject says. Please fix the subject.
ah right. I will resend.
Thanks,
Nirmoy
>
> BR,
> Jani.
>
>
>> Fixes: b35274993680 ("drm/i915: Create a kernel context for GGTT updates")
>> Cc: Oak Zeng <oak.zeng@intel.com>
>> Cc: Andi Shyti <andi.shyti@linux.intel.com>
>> Signed-off-by: Nirmoy Das <nirmoy.das@intel.com>
>> ---
>> drivers/gpu/drm/i915/gt/intel_engine_cs.c | 3 ++-
>> 1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
>> index 179d9546865b..4a11219e560e 100644
>> --- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c
>> +++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
>> @@ -1491,7 +1491,8 @@ static int engine_init_common(struct intel_engine_cs *engine)
>> return 0;
>>
>> err_bce_context:
>> - intel_engine_destroy_pinned_context(bce);
>> + if (bce)
>> + intel_engine_destroy_pinned_context(bce);
>> err_ce_context:
>> intel_engine_destroy_pinned_context(ce);
>> return ret;
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] drm/i915: Prevent potential UAF in engine_init_common
@ 2023-10-11 12:22 ` Nirmoy Das
0 siblings, 0 replies; 10+ messages in thread
From: Nirmoy Das @ 2023-10-11 12:22 UTC (permalink / raw)
To: Jani Nikula, intel-gfx; +Cc: dri-devel, Oak Zeng, Andi Shyti
On 10/11/2023 2:20 PM, Jani Nikula wrote:
> On Wed, 11 Oct 2023, Nirmoy Das <nirmoy.das@intel.com> wrote:
>> If measure_breadcrumb_dw() returns an error and bce isn't created,
>> this commit ensures that intel_engine_destroy_pinned_context()
>> is not called with a NULL bce.
> So it's a potential NULL pointer dereference, not use after free like
> the subject says. Please fix the subject.
ah right. I will resend.
Thanks,
Nirmoy
>
> BR,
> Jani.
>
>
>> Fixes: b35274993680 ("drm/i915: Create a kernel context for GGTT updates")
>> Cc: Oak Zeng <oak.zeng@intel.com>
>> Cc: Andi Shyti <andi.shyti@linux.intel.com>
>> Signed-off-by: Nirmoy Das <nirmoy.das@intel.com>
>> ---
>> drivers/gpu/drm/i915/gt/intel_engine_cs.c | 3 ++-
>> 1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
>> index 179d9546865b..4a11219e560e 100644
>> --- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c
>> +++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
>> @@ -1491,7 +1491,8 @@ static int engine_init_common(struct intel_engine_cs *engine)
>> return 0;
>>
>> err_bce_context:
>> - intel_engine_destroy_pinned_context(bce);
>> + if (bce)
>> + intel_engine_destroy_pinned_context(bce);
>> err_ce_context:
>> intel_engine_destroy_pinned_context(ce);
>> return ret;
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [Intel-gfx] [PATCH] drm/i915: Prevent potential UAF in engine_init_common
2023-10-11 11:54 ` Nirmoy Das
@ 2023-10-11 12:22 ` Andi Shyti
-1 siblings, 0 replies; 10+ messages in thread
From: Andi Shyti @ 2023-10-11 12:22 UTC (permalink / raw)
To: Nirmoy Das; +Cc: intel-gfx, dri-devel
Hi Nirmoy,
On Wed, Oct 11, 2023 at 01:54:51PM +0200, Nirmoy Das wrote:
> If measure_breadcrumb_dw() returns an error and bce isn't created,
> this commit ensures that intel_engine_destroy_pinned_context()
> is not called with a NULL bce.
>
> Fixes: b35274993680 ("drm/i915: Create a kernel context for GGTT updates")
> Cc: Oak Zeng <oak.zeng@intel.com>
> Cc: Andi Shyti <andi.shyti@linux.intel.com>
> Signed-off-by: Nirmoy Das <nirmoy.das@intel.com>
Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
Andi
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] drm/i915: Prevent potential UAF in engine_init_common
@ 2023-10-11 12:22 ` Andi Shyti
0 siblings, 0 replies; 10+ messages in thread
From: Andi Shyti @ 2023-10-11 12:22 UTC (permalink / raw)
To: Nirmoy Das; +Cc: intel-gfx, Oak Zeng, dri-devel, Andi Shyti
Hi Nirmoy,
On Wed, Oct 11, 2023 at 01:54:51PM +0200, Nirmoy Das wrote:
> If measure_breadcrumb_dw() returns an error and bce isn't created,
> this commit ensures that intel_engine_destroy_pinned_context()
> is not called with a NULL bce.
>
> Fixes: b35274993680 ("drm/i915: Create a kernel context for GGTT updates")
> Cc: Oak Zeng <oak.zeng@intel.com>
> Cc: Andi Shyti <andi.shyti@linux.intel.com>
> Signed-off-by: Nirmoy Das <nirmoy.das@intel.com>
Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
Andi
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [Intel-gfx] [PATCH] drm/i915: Prevent potential UAF in engine_init_common
2023-10-11 12:22 ` Andi Shyti
@ 2023-10-11 12:26 ` Nirmoy Das
-1 siblings, 0 replies; 10+ messages in thread
From: Nirmoy Das @ 2023-10-11 12:26 UTC (permalink / raw)
To: Andi Shyti; +Cc: intel-gfx, dri-devel
Hi Andi,
On 10/11/2023 2:22 PM, Andi Shyti wrote:
> Hi Nirmoy,
>
> On Wed, Oct 11, 2023 at 01:54:51PM +0200, Nirmoy Das wrote:
>> If measure_breadcrumb_dw() returns an error and bce isn't created,
>> this commit ensures that intel_engine_destroy_pinned_context()
>> is not called with a NULL bce.
>>
>> Fixes: b35274993680 ("drm/i915: Create a kernel context for GGTT updates")
>> Cc: Oak Zeng <oak.zeng@intel.com>
>> Cc: Andi Shyti <andi.shyti@linux.intel.com>
>> Signed-off-by: Nirmoy Das <nirmoy.das@intel.com>
> Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
Resent with a fixed subject. Please check again.
Thanks,
Nirmoy
>
> Andi
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] drm/i915: Prevent potential UAF in engine_init_common
@ 2023-10-11 12:26 ` Nirmoy Das
0 siblings, 0 replies; 10+ messages in thread
From: Nirmoy Das @ 2023-10-11 12:26 UTC (permalink / raw)
To: Andi Shyti; +Cc: intel-gfx, Oak Zeng, dri-devel
Hi Andi,
On 10/11/2023 2:22 PM, Andi Shyti wrote:
> Hi Nirmoy,
>
> On Wed, Oct 11, 2023 at 01:54:51PM +0200, Nirmoy Das wrote:
>> If measure_breadcrumb_dw() returns an error and bce isn't created,
>> this commit ensures that intel_engine_destroy_pinned_context()
>> is not called with a NULL bce.
>>
>> Fixes: b35274993680 ("drm/i915: Create a kernel context for GGTT updates")
>> Cc: Oak Zeng <oak.zeng@intel.com>
>> Cc: Andi Shyti <andi.shyti@linux.intel.com>
>> Signed-off-by: Nirmoy Das <nirmoy.das@intel.com>
> Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
Resent with a fixed subject. Please check again.
Thanks,
Nirmoy
>
> Andi
^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2023-10-11 12:27 UTC | newest]
Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-10-11 11:54 [Intel-gfx] [PATCH] drm/i915: Prevent potential UAF in engine_init_common Nirmoy Das
2023-10-11 11:54 ` Nirmoy Das
2023-10-11 12:20 ` [Intel-gfx] " Jani Nikula
2023-10-11 12:20 ` Jani Nikula
2023-10-11 12:22 ` [Intel-gfx] " Nirmoy Das
2023-10-11 12:22 ` Nirmoy Das
2023-10-11 12:22 ` [Intel-gfx] " Andi Shyti
2023-10-11 12:22 ` Andi Shyti
2023-10-11 12:26 ` [Intel-gfx] " Nirmoy Das
2023-10-11 12:26 ` Nirmoy Das
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.