Re: [PATCH] drm/xe: Free job before xe_exec_queue_put

["Randhawa, Jagmeet" <jagmeet.randhawa@intel.com>]

On 8/20/2024 1:23 PM, Matthew Brost wrote:
> Free job depends on job->vm being valid, the last xe_exec_queue_put can
> destroy the VM. Prevent UAF by freeing job before xe_exec_queue_put.
>
> Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
> Signed-off-by: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: Jagmeet Randhawa <jagmeet.randhawa@intel.com>
> ---
>   drivers/gpu/drm/xe/xe_sched_job.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/xe/xe_sched_job.c b/drivers/gpu/drm/xe/xe_sched_job.c
> index 44d534e362cd..9628f9deb3c0 100644
> --- a/drivers/gpu/drm/xe/xe_sched_job.c
> +++ b/drivers/gpu/drm/xe/xe_sched_job.c
> @@ -171,12 +171,13 @@ void xe_sched_job_destroy(struct kref *ref)
>   	struct xe_sched_job *job =
>   		container_of(ref, struct xe_sched_job, refcount);
>   	struct xe_device *xe = job_to_xe(job);
> +	struct xe_exec_queue *q = job->q;
>   
>   	xe_sched_job_free_fences(job);
> -	xe_exec_queue_put(job->q);
>   	dma_fence_put(job->fence);
>   	drm_sched_job_cleanup(&job->drm);
>   	job_free(job);
> +	xe_exec_queue_put(q);
>   	xe_pm_runtime_put(xe);
>   }
>