From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E884DC001DF for ; Mon, 24 Jul 2023 01:13:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229753AbjGXBNy (ORCPT ); Sun, 23 Jul 2023 21:13:54 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43728 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229696AbjGXBNv (ORCPT ); Sun, 23 Jul 2023 21:13:51 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3B6821B4; Sun, 23 Jul 2023 18:13:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C569260F00; Mon, 24 Jul 2023 01:13:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7078BC433CD; Mon, 24 Jul 2023 01:13:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1690161229; bh=qPnaq8FRUnokyIGV/+C8uOtrOQuKopM6N67bj+Xd2/8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EJVH1eNhE+zE892q9BNfss/JVfaFIPHQLoe9keVyh30I3nh1662oyQ6A3AQkokxhH OMnVBEXvoXVnfMDu/q8KHdz+urn9p/eQD8vRaollkbUtIPDJ2UfNTgJGrq97yKwLyA xoPByzlM0fglKgDagTfg2AxiF0wURbSZgSS7QV9n3Ez2o/rDsrl49sJgIPQGzvsccg 1v2D9n4j7DwqMYHWWIAE/8ufnAwFtOD1/DVdh6gyUQEMFSCft5e1kK/65eExhTcaW+ wP3grU65w1jTRiFox1xm+aupx6gzySzuNHH4c3Yk2Adab3n711zTMj/GjeVlPU+4XK hYW0nKP82EBoA== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Danilo Krummrich , Luben Tuikov , Sasha Levin , airlied@gmail.com, daniel@ffwll.ch, dri-devel@lists.freedesktop.org Subject: [PATCH AUTOSEL 6.4 03/58] drm/scheduler: set entity to NULL in drm_sched_entity_pop_job() Date: Sun, 23 Jul 2023 21:12:31 -0400 Message-Id: <20230724011338.2298062-3-sashal@kernel.org> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230724011338.2298062-1-sashal@kernel.org> References: <20230724011338.2298062-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-stable-base: Linux 6.4.5 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Danilo Krummrich [ Upstream commit 96c7c2f4d5bd94b15fe63448c087f01607b56f4a ] It already happend a few times that patches slipped through which implemented access to an entity through a job that was already removed from the entities queue. Since jobs and entities might have different lifecycles, this can potentially cause UAF bugs. In order to make it obvious that a jobs entity pointer shouldn't be accessed after drm_sched_entity_pop_job() was called successfully, set the jobs entity pointer to NULL once the job is removed from the entity queue. Moreover, debugging a potential NULL pointer dereference is way easier than potentially corrupted memory through a UAF. Signed-off-by: Danilo Krummrich Link: https://lore.kernel.org/r/20230418100453.4433-1-dakr@redhat.com Reviewed-by: Luben Tuikov Signed-off-by: Luben Tuikov Signed-off-by: Sasha Levin --- drivers/gpu/drm/scheduler/sched_entity.c | 6 ++++++ drivers/gpu/drm/scheduler/sched_main.c | 4 ++++ 2 files changed, 10 insertions(+) diff --git a/drivers/gpu/drm/scheduler/sched_entity.c b/drivers/gpu/drm/scheduler/sched_entity.c index e0a8890a62e23..3e2a31d8190eb 100644 --- a/drivers/gpu/drm/scheduler/sched_entity.c +++ b/drivers/gpu/drm/scheduler/sched_entity.c @@ -448,6 +448,12 @@ struct drm_sched_job *drm_sched_entity_pop_job(struct drm_sched_entity *entity) drm_sched_rq_update_fifo(entity, next->submit_ts); } + /* Jobs and entities might have different lifecycles. Since we're + * removing the job from the entities queue, set the jobs entity pointer + * to NULL to prevent any future access of the entity through this job. + */ + sched_job->entity = NULL; + return sched_job; } diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c index aea5a90ff98b9..cdd67676c3d1b 100644 --- a/drivers/gpu/drm/scheduler/sched_main.c +++ b/drivers/gpu/drm/scheduler/sched_main.c @@ -42,6 +42,10 @@ * the hardware. * * The jobs in a entity are always scheduled in the order that they were pushed. + * + * Note that once a job was taken from the entities queue and pushed to the + * hardware, i.e. the pending queue, the entity must not be referenced anymore + * through the jobs entity pointer. */ #include -- 2.39.2