Intel-GFX Archive on lore.kernel.org
 help / color / mirror / Atom feed
* [Intel-gfx] [PATCH] drm/i915: Avoid potential vm use-after-free
@ 2023-01-19 17:32 Rob Clark
  2023-01-19 18:42 ` [Intel-gfx] ✓ Fi.CI.BAT: success for " Patchwork
                   ` (2 more replies)
  0 siblings, 3 replies; 6+ messages in thread
From: Rob Clark @ 2023-01-19 17:32 UTC (permalink / raw)
  To: dri-devel
  Cc: Rob Clark, Thomas Hellström, intel-gfx, open list,
	Chris Wilson, Daniel Vetter, Rodrigo Vivi, David Airlie,
	katrinzhou

From: Rob Clark <robdclark@chromium.org>

Adding the vm to the vm_xa table makes it visible to userspace, which
could try to race with us to close the vm.  So we need to take our extra
reference before putting it in the table.

Signed-off-by: Rob Clark <robdclark@chromium.org>
---
Note, you could list commit e1a7ab4fca0c ("drm/i915: Remove the vm open
count") as the "fixed" commit, but really the issue seems to go back
much further (with the fix needing some backporting in the process).

 drivers/gpu/drm/i915/gem/i915_gem_context.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/i915/gem/i915_gem_context.c b/drivers/gpu/drm/i915/gem/i915_gem_context.c
index 6250de9b9196..e4b78ab4773b 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c
@@ -1861,11 +1861,19 @@ static int get_ppgtt(struct drm_i915_file_private *file_priv,
 	vm = ctx->vm;
 	GEM_BUG_ON(!vm);
 
+	/*
+	 * Get a reference for the allocated handle.  Once the handle is
+	 * visible in the vm_xa table, userspace could try to close it
+	 * from under our feet, so we need to hold the extra reference
+	 * first.
+	 */
+	i915_vm_get(vm);
+
 	err = xa_alloc(&file_priv->vm_xa, &id, vm, xa_limit_32b, GFP_KERNEL);
-	if (err)
+	if (err) {
+		i915_vm_put(vm);
 		return err;
-
-	i915_vm_get(vm);
+	}
 
 	GEM_BUG_ON(id == 0); /* reserved for invalid/unassigned ppgtt */
 	args->value = id;
-- 
2.38.1


^ permalink raw reply related	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2023-01-27 13:50 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-01-19 17:32 [Intel-gfx] [PATCH] drm/i915: Avoid potential vm use-after-free Rob Clark
2023-01-19 18:42 ` [Intel-gfx] ✓ Fi.CI.BAT: success for " Patchwork
2023-01-20 22:03 ` [Intel-gfx] ✓ Fi.CI.IGT: " Patchwork
2023-01-23 16:56 ` [Intel-gfx] [PATCH] " Tvrtko Ursulin
2023-01-27 13:10   ` Matthew Auld
2023-01-27 13:50     ` Tvrtko Ursulin

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox