[PATCH] drm/i915: Fix UAF race between relocation and GEM_CLOSE

[Yassine Mounir <sosohero200@gmail.com>]

A use-after-free (UAF) vulnerability was identified in the i915 driver 
within eb_relocate_vma. The issue arises from a race condition where 
a concurrent DRM_IOCTL_GEM_CLOSE can drop the GEM object's reference 
count to zero while the relocation thread is still processing entries.

This results in the kernel attempting to access freed memory in 
eb_relocate_entry, leading to a display pipeline hang and potential 
system instability.

Fix:
Wrap the relocation phase with i915_gem_object_get() and 
i915_gem_object_put() to ensure the object remains valid throughout 
the operation, even if user-space requests to close the handle.

Reported-by: Yassine Mounir (Toji1) <sosohero200@gmail.com>
Signed-off-by: Yassine Mounir <sosohero200@gmail.com>
---
 drivers/gpu/drm/i915/i915_gem_execbuffer.c | 4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -1542,7 +1542,11 @@ eb_relocate_vma(struct i915_execbuffer *eb, struct i915_vma *vma)
 		if (ret)
 			return ret;
 
+		/* Hold a reference to prevent UAF during concurrent GEM_CLOSE */
+		i915_gem_object_get(vma->obj);
 		ret = eb_relocate_entry(eb, vma, rel);
+		i915_gem_object_put(vma->obj);
+
 		if (ret)
 			return ret;
 	}