From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f45.google.com (mail-qv1-f45.google.com [209.85.219.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A4149361670 for ; Sun, 9 Aug 2026 17:37:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.45 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786297044; cv=none; b=j10IakwgmxzZumvN22V1+QkLGatTAcMxREgGQJwSxTeKxxo+rss9DssbHYQ8lY2V7fhC8yvlTuXWWuLxl6hzUlYbcEDdwSz1OXDVA60ZkHLR3j6FG0lALDTTe1yIqDtXZ+5jNBaN8zSFYEcyjfRTqFqk5z7WMNuFgA1FdO+EDkI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786297044; c=relaxed/simple; bh=iW+Fmt84r/jOM4AJjU1cEErKScitlaJqG/PyeuPEOPU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=nrdJH1wVLhFAaiccDZj6hApdeJRLrK007TsF7rFq7dcp38Vg4rywIyJxdYUWP/M3l15dou4GnFGPXJbz7qy0NurFBl+91JXV4mabm9uNhQ7oYSIc6Xd/yWL0XYF26AHYUvIPCd7c/ML9rtjPpDt/uqbCDvHjaXFT3XMDPl/lzeA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ZjUo5Z5Y; arc=none smtp.client-ip=209.85.219.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ZjUo5Z5Y" Received: by mail-qv1-f45.google.com with SMTP id 6a1803df08f44-8efb708b1a0so5793786d6.3 for ; Sun, 09 Aug 2026 10:37:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786297041; x=1786901841; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=UDwhP+SNEQonzNCu80xIUxXIG/Qn0ez/r1xaxvU+zXo=; b=ZjUo5Z5YDfarTvXUZWKRdssqG1KvjArs9AAdaH+PPrffYMw7bLuaDT2+HhzztYpyeg 6+E3NquTho49gwQeUiOb3MzxFfFLpu2v21WFaUupaDss8B7/05v0VbjwSKSLDhaGj9Ah oW5LeTfym3XW+xY7TT2QZ4u+Ps/DOGj++oZCw6CsMyRd8lmOmz5RXfqVI3Xf9sVmzrqN B7p0aY/wltllOILmfXW7h4Wg/TMrh5uDXSLwZFitL8ky+7WwZMv9LSUVMxrDtlNX7h8B IYIZA5+gg7v5MLtIBw8ZjJzSo/Reep2m7lRvm1fM1yph5UIZKtam79Loq7Qv2enW6rbE vY2w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786297041; x=1786901841; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=UDwhP+SNEQonzNCu80xIUxXIG/Qn0ez/r1xaxvU+zXo=; b=YLgG62wf4GyFhy0B4MENCvfcvCnopBCnCH6OSpaXnbYYpJ23ge0Mhvnj0RnIoeJ8Eh 2+u8xOctt79qY9sHXRtk65BKR7krmQw94vnUbw35q6btZmiLdLmt0/TyFqawAtnklHfk S+TtzUjYwuMKYxaLp/u7hGO8G1q8oaWZVElx2D160yK07rMOzfFzAkpdu9eRqM7wxVxC ispcWQ2pUmt2dfUuhM70h/kIdV05b4U/kmTugMcz0yuLyQYvfJpzgdmHI0w92O5ATUQ2 GSd1bT7YKap2ajJUJyrKFixbRBiin3VFxDC2N57xJmE4+IlprLRRk2BMImE8MeWvd4oy sG4g== X-Forwarded-Encrypted: i=1; AHgh+RoPGjxcYOZiZiqYyYS5fvcIIljSijT2vJQMWUeHyuIQWZtaTLcIlcfIJZOnFwQ0muhAz7I/fvelL5mwx2s=@vger.kernel.org X-Gm-Message-State: AOJu0YzlFvvI4LsfBkxunZFnxbaQoJP4c0L4e6nXR0RJhgUEnFqfxj87 qoudvpxsMGIekMPuBbjdvG1VpJq9cLVKDLueq+Px4es8veUHSBPEO4JM X-Gm-Gg: AR+sD10PesuXdfKMJZcdpNBh8qHO9fhrNNLm6vUWLwZ+5w56JcZfUlk9PKDJwe+Baws PIyRI2+B9H8Lfioiprb+oahZh1YRd94HftUGrXdReCwn5ekyPjPLfEJAKNe6JO78Pi6EhO037KG zItHo5V/BHxHiYFacpThw96dXuTGoYwJnbBMhhfEt+vpz7p1UwBPE5l0MvOzPtuby6FdnUaS8lU jXp2JbCs1dimJIgHwMgJ0K2NNclSoEH7R30ItsToaGhTzrR19l3PSRk1Wq7BWR0MN+qUQMg/z32 d5W+74B+0Ru7ixaMEDznIa/bQR2XyEB3HrwxPQOjHHAhjslIZ6glugO//onuiT97Uwvn2Ku8Fq3 9gz1V2dH3Gu2NlYEszy/OKDbwU/6mlF6cBwumL6Kh5FsfARqOGT2CcOrun2vAiCDIrlfCT8YwjI Hk17qsoJelVSOxXT4v0aRPAHWkufKNeSb5CUgKCx6bncqrbCCJaaSPmV6TZtN+s6gPxa5mB3dWK nPUGXCWomswdVXmn1b1lOv/2X8T X-Received: by 2002:a05:6214:4f06:b0:908:9045:217a with SMTP id 6a1803df08f44-908904526e0mr330626976d6.29.1786297041447; Sun, 09 Aug 2026 10:37:21 -0700 (PDT) Received: from i4-l-hqh5357-03.ad.psu.edu ([130.203.139.71]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-908a918ec9fsm55388176d6.5.2026.08.09.10.37.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Aug 2026 10:37:21 -0700 (PDT) From: Shuangpeng Bai To: intel-gfx@lists.freedesktop.org Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, jani.nikula@linux.intel.com, joonas.lahtinen@linux.intel.com, rodrigo.vivi@intel.com, tursulin@ursulin.net, chris@chris-wilson.co.uk, Shuangpeng Bai , stable@vger.kernel.org Subject: [PATCH] drm/i915/gem: Fix request use-after-free in active_engine() Date: Sun, 9 Aug 2026 13:36:46 -0400 Message-ID: <20260809173646.3292361-1-shuangpeng.kernel@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit active_engine() walks timeline->requests in reverse under RCU and takes a temporary reference before inspecting each request. However, it drops that reference in the loop body before list_for_each_entry_reverse() advances the cursor. Concurrent retirement can unlink the same request and drop its base reference while active_engine() holds the temporary reference. The put in active_engine() may then be final, freeing or recycling the request before the loop step reads rq->link.prev. SLAB_TYPESAFE_BY_RCU does not defer that reuse. Open-code the reverse walk and cache the previous request while the current request is still referenced. The next request remains protected by i915_request_get_rcu() and validated against the timeline before use. An i915 mock selftest forced retirement between the active check and cursor advance. The vulnerable tree reached the final request release and kmem_cache_free(), while the fixed tree completed the same ordering without accessing rq after the put. Fixes: 3cfea8c97c93 ("drm/i915/gem: Hold request reference for canceling an active context") Cc: stable@vger.kernel.org # v5.10+ Signed-off-by: Shuangpeng Bai --- drivers/gpu/drm/i915/gem/i915_gem_context.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/i915/gem/i915_gem_context.c b/drivers/gpu/drm/i915/gem/i915_gem_context.c index c58ffa5a8fa6..ff5c892a0176 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_context.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c @@ -1361,7 +1361,7 @@ static bool __cancel_engine(struct intel_engine_cs *engine) static struct intel_engine_cs *active_engine(struct intel_context *ce) { struct intel_engine_cs *engine = NULL; - struct i915_request *rq; + struct i915_request *rq, *prev; if (intel_context_has_inflight(ce)) return intel_context_inflight(ce); @@ -1375,7 +1375,8 @@ static struct intel_engine_cs *active_engine(struct intel_context *ce) * (and onto a new timeline->requests list). */ rcu_read_lock(); - list_for_each_entry_reverse(rq, &ce->timeline->requests, link) { + rq = list_last_entry(&ce->timeline->requests, typeof(*rq), link); + while (!list_entry_is_head(rq, &ce->timeline->requests, link)) { bool found; /* timeline is already completed upto this point? */ @@ -1387,9 +1388,14 @@ static struct intel_engine_cs *active_engine(struct intel_context *ce) if (likely(rcu_access_pointer(rq->timeline) == ce->timeline)) found = i915_request_active_engine(rq, &engine); + /* Cache the cursor before the put, which may release rq. */ + if (!found) + prev = list_prev_entry(rq, link); i915_request_put(rq); if (found) break; + + rq = prev; } rcu_read_unlock(); base-commit: a59f57e2aa127c5354168d2ec4bac920df1be4f4 -- 2.43.0