Re: [PATCH] drm/i915: Fix UAF race between relocation and GEM_CLOSE

[Greg KH <gregkh@linuxfoundation.org>]

On Tue, Mar 24, 2026 at 09:47:18AM -0400, Yassine Mounir wrote:
> A use-after-free (UAF) vulnerability was identified in the i915 driver 
> within eb_relocate_vma. The issue arises from a race condition where 
> a concurrent DRM_IOCTL_GEM_CLOSE can drop the GEM object's reference 
> count to zero while the relocation thread is still processing entries.
> 
> This results in the kernel attempting to access freed memory in 
> eb_relocate_entry, leading to a display pipeline hang and potential 
> system instability.
> 
> Fix:
> Wrap the relocation phase with i915_gem_object_get() and 
> i915_gem_object_put() to ensure the object remains valid throughout 
> the operation, even if user-space requests to close the handle.
> 
> Reported-by: Yassine Mounir (Toji1) <sosohero200@gmail.com>
> Signed-off-by: Yassine Mounir <sosohero200@gmail.com>

No need for a reported-by when you create and sign off on a change.

> ---
>  drivers/gpu/drm/i915/i915_gem_execbuffer.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> --- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
> +++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c

There is no such file name in the current kernel tree, what version did
you make this against?


> @@ -1542,7 +1542,11 @@ eb_relocate_vma(struct i915_execbuffer *eb, struct i915_vma *vma)
>  		if (ret)
>  			return ret;
>  
> +		/* Hold a reference to prevent UAF during concurrent GEM_CLOSE */
> +		i915_gem_object_get(vma->obj);
>  		ret = eb_relocate_entry(eb, vma, rel);
> +		i915_gem_object_put(vma->obj);
> +

What prevents the object from going away right after the put call here?

thanks,

greg k-h