Intel-XE Archive on lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] drm/xe: Free job before xe_exec_queue_put
@ 2024-08-20 20:23 Matthew Brost
  2024-08-20 20:27 ` Nirmoy Das
                   ` (10 more replies)
  0 siblings, 11 replies; 13+ messages in thread
From: Matthew Brost @ 2024-08-20 20:23 UTC (permalink / raw)
  To: intel-xe

Free job depends on job->vm being valid, the last xe_exec_queue_put can
destroy the VM. Prevent UAF by freeing job before xe_exec_queue_put.

Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Signed-off-by: Matthew Brost <matthew.brost@intel.com>
---
 drivers/gpu/drm/xe/xe_sched_job.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/xe/xe_sched_job.c b/drivers/gpu/drm/xe/xe_sched_job.c
index 44d534e362cd..9628f9deb3c0 100644
--- a/drivers/gpu/drm/xe/xe_sched_job.c
+++ b/drivers/gpu/drm/xe/xe_sched_job.c
@@ -171,12 +171,13 @@ void xe_sched_job_destroy(struct kref *ref)
 	struct xe_sched_job *job =
 		container_of(ref, struct xe_sched_job, refcount);
 	struct xe_device *xe = job_to_xe(job);
+	struct xe_exec_queue *q = job->q;
 
 	xe_sched_job_free_fences(job);
-	xe_exec_queue_put(job->q);
 	dma_fence_put(job->fence);
 	drm_sched_job_cleanup(&job->drm);
 	job_free(job);
+	xe_exec_queue_put(q);
 	xe_pm_runtime_put(xe);
 }
 
-- 
2.34.1


^ permalink raw reply related	[flat|nested] 13+ messages in thread

end of thread, other threads:[~2024-08-21 15:24 UTC | newest]

Thread overview: 13+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-08-20 20:23 [PATCH] drm/xe: Free job before xe_exec_queue_put Matthew Brost
2024-08-20 20:27 ` Nirmoy Das
2024-08-20 20:36 ` ✓ CI.Patch_applied: success for " Patchwork
2024-08-20 20:36 ` ✓ CI.checkpatch: " Patchwork
2024-08-20 20:37 ` ✓ CI.KUnit: " Patchwork
2024-08-20 20:55 ` ✓ CI.Build: " Patchwork
2024-08-20 20:57 ` ✓ CI.Hooks: " Patchwork
2024-08-20 20:59 ` ✓ CI.checksparse: " Patchwork
2024-08-20 21:03 ` [PATCH] " Randhawa, Jagmeet
2024-08-20 21:35 ` ✓ CI.BAT: success for " Patchwork
2024-08-21  4:24 ` ✗ CI.FULL: failure " Patchwork
2024-08-21  6:22 ` [PATCH] " Ghimiray, Himal Prasad
2024-08-21 15:23   ` Matthew Brost

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox