From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id F0D90CA600A for ; Thu, 8 Oct 2026 08:54:06 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 285C810E5D0; Thu, 8 Oct 2026 08:54:06 +0000 (UTC) Authentication-Results: gabe.freedesktop.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=arm.com header.i=@arm.com header.b="lnMwii2E"; dkim-atps=neutral Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by gabe.freedesktop.org (Postfix) with ESMTP id 9607810E5D0 for ; Thu, 8 Oct 2026 08:54:04 +0000 (UTC) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 9CAA11691 for ; Thu, 8 Oct 2026 01:54:00 -0700 (PDT) Received: from [10.2.11.34] (usa-sjc-imap-foss1.foss.arm.com [10.121.207.14]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 9A1F23F763 for ; Thu, 8 Oct 2026 01:54:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=arm.com; s=foss; t=1791449643; bh=kv5z2TT6AyAkWoFsdmXPAE51rmMlmY8WTTT3zFEcWSQ=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=lnMwii2EtxgcDuG3ZtTveDkIDEtLhrvYOsh6n4QVwTXnkU6bubSCl7SpGkbaxHTa9 0e4+fmn03FwhtYLGYzBq4bd0baWe3Gmdlsrd/ItXpQserdHi6CHNSzqUd3JexFPrI+ xlwfUz8aw6oB51aH9FlAFRnHd3vZSe/iaTCe6nKg= Date: Thu, 8 Oct 2026 09:53:50 +0100 From: Liviu Dudau To: Osama Abdelkader Cc: Boris Brezillon , Steven Price , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Akash Goel , Chia-I Wu , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH] drm/panthor: Fix TOCTOU race between GROUP_REGISTERED check and erase Message-ID: References: <20261007181220.2418060-1-osama.abdelkader@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20261007181220.2418060-1-osama.abdelkader@gmail.com> X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" On Wed, Oct 07, 2026 at 08:12:19PM +0200, Osama Abdelkader wrote: > panthor_group_destroy() checks the GROUP_REGISTERED mark and then calls > xa_erase() without holding the xarray lock across both. If the handle is > destroyed by another thread in between, and a concurrent GROUP_CREATE > reuses the freed ID, the first destroy erases and releases the new, > still-initializing group, leading to a use-after-free in > panthor_group_create(). > > Do the mark check and erase atomically under xa_lock(). > > Fixes: eec7e23d848d ("drm/panthor: Prevent potential UAF in group creation") > Cc: stable@vger.kernel.org > Signed-off-by: Osama Abdelkader Reviewed-by: Liviu Dudau As Boris mentioned, please let us know if LLM has assisted in finding the bug or in the creation of the patch before we can merge the fix. Best regards, Liviu > --- > drivers/gpu/drm/panthor/panthor_sched.c | 14 ++++++++++---- > 1 file changed, 10 insertions(+), 4 deletions(-) > > diff --git a/drivers/gpu/drm/panthor/panthor_sched.c b/drivers/gpu/drm/panthor/panthor_sched.c > index 0493858e55d7..a343c5180e01 100644 > --- a/drivers/gpu/drm/panthor/panthor_sched.c > +++ b/drivers/gpu/drm/panthor/panthor_sched.c > @@ -3770,12 +3770,18 @@ int panthor_group_destroy(struct panthor_file *pfile, u32 group_handle) > struct panthor_group_pool *gpool = pfile->groups; > struct panthor_device *ptdev = pfile->ptdev; > struct panthor_scheduler *sched = ptdev->scheduler; > - struct panthor_group *group; > + struct panthor_group *group = NULL; > > - if (!xa_get_mark(&gpool->xa, group_handle, GROUP_REGISTERED)) > - return -EINVAL; > + /* > + * Check the mark and erase the entry atomically, so a concurrent > + * destroy + create can't make us erase a group that's still being > + * initialized and happens to reuse the same handle. > + */ > + xa_lock(&gpool->xa); > + if (xa_get_mark(&gpool->xa, group_handle, GROUP_REGISTERED)) > + group = __xa_erase(&gpool->xa, group_handle); > + xa_unlock(&gpool->xa); > > - group = xa_erase(&gpool->xa, group_handle); > if (!group) > return -EINVAL; > > -- > 2.53.0 > -- ==================== | I would like to | | fix the world, | | but they're not | | giving me the | \ source code! / --------------- ¯\_(ツ)_/¯