public inbox for intel-gfx@lists.freedesktop.org
 help / color / mirror / Atom feed
* [PATCH] drm/i915: Fix VMA UAF in execbuf setup
@ 2026-04-14 19:57 Janusz Krzysztofik
  2026-04-14 20:53 ` ✓ i915.CI.BAT: success for " Patchwork
                   ` (3 more replies)
  0 siblings, 4 replies; 5+ messages in thread
From: Janusz Krzysztofik @ 2026-04-14 19:57 UTC (permalink / raw)
  To: intel-gfx
  Cc: dri-devel, Jani Nikula, Joonas Lahtinen, Rodrigo Vivi,
	Tvrtko Ursulin, Simona Vetter, Chris Wilson,
	Ville Syrjälä, Andi Shyti, Krzysztof Karas,
	Krzysztof Niemiec, Sebastian Brzezinka, Janusz Krzysztofik

We now depend on RCU protection when looking up VMAs associated with GEM
objects of an execbuf task in a radix tree based lookup table of a user
GEM context for that execbuf.  That's not sufficient.  While the radix
tree itself, as well as GEM objects, freed by RCU, are safe, VMA items are
not, and memory they occupy can be freed concurrently if another thread is
doing a cleanup.

[550.183466] Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] SMP PTI
[550.183490] CPU: 6 UID: 0 PID: 18815 Comm: gem_reloc_race Tainted: G S   U       L   N  7.0.0-CI_DRM_18329-g4e3f5ea9aacc+ #1 PREEMPT(lazy)
[550.183508] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER, [L]=SOFTLOCKUP, [N]=TEST
[550.183517] Hardware name: Dell Inc. XPS 8300  /0Y2MRG, BIOS A06 10/17/2011
[550.183527] RIP: 0010:eb_lookup_vma+0x89/0x770 [i915]
[550.183909] Code: 00 00 00 49 8b 44 24 38 4c 89 f6 48 8d b8 20 02 00 00 e8 1a 65 c2 e1 48 89 c3 48 85 c0 0f 84 c8 00 00 00 48 8b b8 c0 00 00 00 <8b> 17 85 d2 0f 84 b7 00 00 00 8d 4a 01 89 d0 f0 0f b1 0f 0f 85 53
[550.183928] RSP: 0018:ffffc90001aeb7e8 EFLAGS: 00010282
[550.183938] RAX: ffff888175b4cb40 RBX: ffff888175b4cb40 RCX: 0000000000000000
[550.183948] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 6b6b6b6b6b6b6b6b
[550.183957] RBP: ffffc90001aeb848 R08: 0000000000000000 R09: 0000000000000000
[550.183966] R10: 0000000000000000 R11: 0000000000000000 R12: ffffc90001aeb8b8
[550.183975] R13: 0000000000000003 R14: 0000000000000003 R15: ffffffffa0ced6f2
[550.183984] FS:  00007a83cce026c0(0000) GS:ffff8882a3997000(0000) knlGS:0000000000000000
[550.183995] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[550.184004] CR2: 00007b5f1317e428 CR3: 0000000179690003 CR4: 00000000000626f0
[550.184016] Call Trace:
[550.184021]  <TASK>
[550.184031]  i915_gem_do_execbuffer+0xc84/0x36e0 [i915]
[550.184362]  ? lock_release+0xd0/0x2b0
[550.184376]  ? is_bpf_text_address+0x74/0x140
[550.184387]  ? kernel_text_address+0x139/0x150
[550.184398]  ? unwind_get_return_address+0x25/0x50
[550.184410]  ? __lock_acquire+0x43e/0x2790
[550.184421]  ? stack_depot_save_flags+0x28/0x960
[550.184435]  ? __lock_acquire+0x43e/0x2790
[550.184446]  ? find_held_lock+0x31/0x90
[550.184455]  ? __create_object+0x68/0xc0
[550.184470]  ? lock_acquire+0xc4/0x2f0
[550.184479]  ? find_held_lock+0x31/0x90
[550.184489]  ? __might_fault+0x53/0xb0
[550.184505]  i915_gem_execbuffer2_ioctl+0x169/0x320 [i915]

Protect a VMA item retrieved from the context lookup table with a mutex
associated with that table while taking a reference to an underlying GEM
object.

Fixes: f7ce8639f6ff7 ("drm/i915/gem: Split the context's obj:vma lut into its own mutex")
Cc: stable@vger.kernel.org # v5.9+
Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
---
 drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
index 65ce54b20ec29..d79e3f2d1cbb4 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
@@ -894,6 +894,7 @@ static struct i915_vma *eb_lookup_vma(struct i915_execbuffer *eb, u32 handle)
 		struct i915_vma *vma;
 		int err;
 
+		mutex_lock(&eb->gem_context->lut_mutex);
 		rcu_read_lock();
 		vma = radix_tree_lookup(&eb->gem_context->handles_vma, handle);
 		if (likely(vma))
@@ -901,6 +902,7 @@ static struct i915_vma *eb_lookup_vma(struct i915_execbuffer *eb, u32 handle)
 		else
 			vma = NULL;
 		rcu_read_unlock();
+		mutex_unlock(&eb->gem_context->lut_mutex);
 		if (likely(vma))
 			return vma;
 
-- 
2.53.0


^ permalink raw reply related	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2026-04-15 12:24 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-04-14 19:57 [PATCH] drm/i915: Fix VMA UAF in execbuf setup Janusz Krzysztofik
2026-04-14 20:53 ` ✓ i915.CI.BAT: success for " Patchwork
2026-04-15  5:41 ` ✓ i915.CI.Full: " Patchwork
2026-04-15 10:49 ` [PATCH] " Andi Shyti
2026-04-15 12:24 ` Sebastian Brzezinka

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox