[PATCH v5 1/2] drm/ttm: Fix UAF on dma-buf attach failure for sg BOs

[PATCH v5 1/2] drm/ttm: Fix UAF on dma-buf attach failure for sg BOs

[Nitin Gote]

When a dma-buf importer creates a ttm_bo_type_sg BO with bo->base.resv
pointing at the exporter's dma_buf->resv and dma_buf_dynamic_attach()
fails, no dma_buf reference is held. The exporter can be freed before
the delayed_delete worker calls dma_resv_lock(bo->base.resv), causing a
use-after-free:

  Oops: general protection fault, probably for non-canonical address
        0x6b6b6b6b6b6b6b9c
  Workqueue: ttm ttm_bo_delayed_delete [ttm]
  RIP: 0010:mutex_can_spin_on_owner+0x3f/0xc0

ttm_bo_individualize_resv() skips the resv swap for all sg BOs to keep
the shared resv available for delayed_delete to release the dma-buf
mapping. A BO whose attach never succeeded has no mapping to release,
yet it keeps bo->base.resv pointing at the exporter resv that
delayed_delete later locks once the exporter is gone.

Fix this by checking bo->base.import_attach, which is set only after a
successful attach. The check is placed after dma_resv_copy_fences() so
successful imports still copy fences to _resv before returning, keeping
the shared resv for delayed_delete. Failed imports fall through to swap
resv to _resv, so delayed_delete never locks the stale exporter resv.

Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/8023
Fixes: d99fbd9aab62 ("drm/ttm: Always take the bo delayed cleanup path for imported bos")
Cc: stable@vger.kernel.org # v6.8+
Cc: Thomas Hellstrom <thomas.hellstrom@linux.intel.com>
Cc: Christian Konig <christian.koenig@amd.com>
Cc: Matthew Auld <matthew.auld@intel.com>
Assisted-by: GitHub_Copilot:claude-sonnet-4.6
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Nitin Gote <nitin.r.gote@intel.com>
---
 drivers/gpu/drm/ttm/ttm_bo.c | 24 +++++++++++++++---------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 3980f376e3ba..f157e259dd5f 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -203,15 +203,21 @@ static int ttm_bo_individualize_resv(struct ttm_buffer_object *bo)
 	if (r)
 		return r;
 
-	if (bo->type != ttm_bo_type_sg) {
-		/* This works because the BO is about to be destroyed and nobody
-		 * reference it any more. The only tricky case is the trylock on
-		 * the resv object while holding the lru_lock.
-		 */
-		spin_lock(&bo->bdev->lru_lock);
-		bo->base.resv = &bo->base._resv;
-		spin_unlock(&bo->bdev->lru_lock);
-	}
+	/*
+	 * Successfully imported sg BOs need the shared resv for dma-buf
+	 * cleanup. Failed imports have no attachment or mapping and can
+	 * use the private _resv.
+	 */
+	if (bo->type == ttm_bo_type_sg && bo->base.import_attach)
+		return 0;
+
+	/* This works because the BO is about to be destroyed and nobody
+	 * references it any more. The only tricky case is the trylock on
+	 * the resv object while holding the lru_lock.
+	 */
+	spin_lock(&bo->bdev->lru_lock);
+	bo->base.resv = &bo->base._resv;
+	spin_unlock(&bo->bdev->lru_lock);
 
 	return r;
 }
-- 
2.50.1

Re: [PATCH v5 1/2] drm/ttm: Fix UAF on dma-buf attach failure for sg BOs

[Thomas Hellström]

Hi, Nitin,

On Wed, 2026-07-08 at 14:45 +0530, Nitin Gote wrote:
> When a dma-buf importer creates a ttm_bo_type_sg BO with bo-
> >base.resv
> pointing at the exporter's dma_buf->resv and dma_buf_dynamic_attach()
> fails, no dma_buf reference is held. The exporter can be freed before
> the delayed_delete worker calls dma_resv_lock(bo->base.resv), causing
> a
> use-after-free:
> 
>   Oops: general protection fault, probably for non-canonical address
>         0x6b6b6b6b6b6b6b9c
>   Workqueue: ttm ttm_bo_delayed_delete [ttm]
>   RIP: 0010:mutex_can_spin_on_owner+0x3f/0xc0
> 
> ttm_bo_individualize_resv() skips the resv swap for all sg BOs to
> keep
> the shared resv available for delayed_delete to release the dma-buf
> mapping. A BO whose attach never succeeded has no mapping to release,
> yet it keeps bo->base.resv pointing at the exporter resv that
> delayed_delete later locks once the exporter is gone.
> 
> Fix this by checking bo->base.import_attach, which is set only after
> a
> successful attach. The check is placed after dma_resv_copy_fences()
> so
> successful imports still copy fences to _resv before returning,
> keeping
> the shared resv for delayed_delete. Failed imports fall through to
> swap
> resv to _resv, so delayed_delete never locks the stale exporter resv.
> 
> Closes:
> https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/8023
> Fixes: d99fbd9aab62 ("drm/ttm: Always take the bo delayed cleanup
> path for imported bos")
> Cc: stable@vger.kernel.org # v6.8+
> Cc: Thomas Hellstrom <thomas.hellstrom@linux.intel.com>
> Cc: Christian Konig <christian.koenig@amd.com>
> Cc: Matthew Auld <matthew.auld@intel.com>
> Assisted-by: GitHub_Copilot:claude-sonnet-4.6
> Reviewed-by: Christian König <christian.koenig@amd.com>
> Signed-off-by: Nitin Gote <nitin.r.gote@intel.com>

It seems you dropped the patch changelog?

Also the WARN_ON_ONCE() we discussed for last version?

/Thomas



> ---
>  drivers/gpu/drm/ttm/ttm_bo.c | 24 +++++++++++++++---------
>  1 file changed, 15 insertions(+), 9 deletions(-)
> 
> diff --git a/drivers/gpu/drm/ttm/ttm_bo.c
> b/drivers/gpu/drm/ttm/ttm_bo.c
> index 3980f376e3ba..f157e259dd5f 100644
> --- a/drivers/gpu/drm/ttm/ttm_bo.c
> +++ b/drivers/gpu/drm/ttm/ttm_bo.c
> @@ -203,15 +203,21 @@ static int ttm_bo_individualize_resv(struct
> ttm_buffer_object *bo)
>  	if (r)
>  		return r;
>  
> -	if (bo->type != ttm_bo_type_sg) {
> -		/* This works because the BO is about to be
> destroyed and nobody
> -		 * reference it any more. The only tricky case is
> the trylock on
> -		 * the resv object while holding the lru_lock.
> -		 */
> -		spin_lock(&bo->bdev->lru_lock);
> -		bo->base.resv = &bo->base._resv;
> -		spin_unlock(&bo->bdev->lru_lock);
> -	}
> +	/*
> +	 * Successfully imported sg BOs need the shared resv for
> dma-buf
> +	 * cleanup. Failed imports have no attachment or mapping and
> can
> +	 * use the private _resv.
> +	 */
> +	if (bo->type == ttm_bo_type_sg && bo->base.import_attach)
> +		return 0;
> +
> +	/* This works because the BO is about to be destroyed and
> nobody
> +	 * references it any more. The only tricky case is the
> trylock on
> +	 * the resv object while holding the lru_lock.
> +	 */
> +	spin_lock(&bo->bdev->lru_lock);
> +	bo->base.resv = &bo->base._resv;
> +	spin_unlock(&bo->bdev->lru_lock);
>  
>  	return r;
>  }

RE: [PATCH v5 1/2] drm/ttm: Fix UAF on dma-buf attach failure for sg BOs

[Gote, Nitin R]

> -----Original Message-----
> From: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> Sent: Wednesday, July 8, 2026 6:08 PM
> To: Gote, Nitin R <nitin.r.gote@intel.com>; intel-xe@lists.freedesktop.org
> Cc: stable@vger.kernel.org; Christian Konig <christian.koenig@amd.com>; Auld,
> Matthew <matthew.auld@intel.com>
> Subject: Re: [PATCH v5 1/2] drm/ttm: Fix UAF on dma-buf attach failure for sg BOs
> 
> Hi, Nitin,
> 
> On Wed, 2026-07-08 at 14:45 +0530, Nitin Gote wrote:
> > When a dma-buf importer creates a ttm_bo_type_sg BO with bo-
> > >base.resv
> > pointing at the exporter's dma_buf->resv and dma_buf_dynamic_attach()
> > fails, no dma_buf reference is held. The exporter can be freed before
> > the delayed_delete worker calls dma_resv_lock(bo->base.resv), causing
> > a
> > use-after-free:
> >
> >   Oops: general protection fault, probably for non-canonical address
> >         0x6b6b6b6b6b6b6b9c
> >   Workqueue: ttm ttm_bo_delayed_delete [ttm]
> >   RIP: 0010:mutex_can_spin_on_owner+0x3f/0xc0
> >
> > ttm_bo_individualize_resv() skips the resv swap for all sg BOs to keep
> > the shared resv available for delayed_delete to release the dma-buf
> > mapping. A BO whose attach never succeeded has no mapping to release,
> > yet it keeps bo->base.resv pointing at the exporter resv that
> > delayed_delete later locks once the exporter is gone.
> >
> > Fix this by checking bo->base.import_attach, which is set only after a
> > successful attach. The check is placed after dma_resv_copy_fences() so
> > successful imports still copy fences to _resv before returning,
> > keeping the shared resv for delayed_delete. Failed imports fall
> > through to swap resv to _resv, so delayed_delete never locks the stale
> > exporter resv.
> >
> > Closes:
> > https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/8023
> > Fixes: d99fbd9aab62 ("drm/ttm: Always take the bo delayed cleanup path
> > for imported bos")
> > Cc: stable@vger.kernel.org # v6.8+
> > Cc: Thomas Hellstrom <thomas.hellstrom@linux.intel.com>
> > Cc: Christian Konig <christian.koenig@amd.com>
> > Cc: Matthew Auld <matthew.auld@intel.com>
> > Assisted-by: GitHub_Copilot:claude-sonnet-4.6
> > Reviewed-by: Christian König <christian.koenig@amd.com>
> > Signed-off-by: Nitin Gote <nitin.r.gote@intel.com>
> 
> It seems you dropped the patch changelog?
> 
> Also the WARN_ON_ONCE() we discussed for last version?
> 

Sorry about both.
I had added the changelog in the cover letter only; I'll add it below the --- in the patch as well.

Also, I should have kept it. Will add it back: WARN_ON_ONCE(bo->type == ttm_bo_type_sg && bo->resource);

With the xe patch (patch 2)applied, this should not hit for xe anymore, but yes it will help to catch other driver that makes a failed sg import LRU-visible before attach succeeds.
I will update this in v6.

Thank you,
Nitin 

> /Thomas
> 
> 
> 
> > ---
> >  drivers/gpu/drm/ttm/ttm_bo.c | 24 +++++++++++++++---------
> >  1 file changed, 15 insertions(+), 9 deletions(-)
> >
> > diff --git a/drivers/gpu/drm/ttm/ttm_bo.c
> > b/drivers/gpu/drm/ttm/ttm_bo.c index 3980f376e3ba..f157e259dd5f 100644
> > --- a/drivers/gpu/drm/ttm/ttm_bo.c
> > +++ b/drivers/gpu/drm/ttm/ttm_bo.c
> > @@ -203,15 +203,21 @@ static int ttm_bo_individualize_resv(struct
> > ttm_buffer_object *bo)
> >  	if (r)
> >  		return r;
> >
> > -	if (bo->type != ttm_bo_type_sg) {
> > -		/* This works because the BO is about to be
> > destroyed and nobody
> > -		 * reference it any more. The only tricky case is
> > the trylock on
> > -		 * the resv object while holding the lru_lock.
> > -		 */
> > -		spin_lock(&bo->bdev->lru_lock);
> > -		bo->base.resv = &bo->base._resv;
> > -		spin_unlock(&bo->bdev->lru_lock);
> > -	}
> > +	/*
> > +	 * Successfully imported sg BOs need the shared resv for
> > dma-buf
> > +	 * cleanup. Failed imports have no attachment or mapping and
> > can
> > +	 * use the private _resv.
> > +	 */
> > +	if (bo->type == ttm_bo_type_sg && bo->base.import_attach)
> > +		return 0;
> > +
> > +	/* This works because the BO is about to be destroyed and
> > nobody
> > +	 * references it any more. The only tricky case is the
> > trylock on
> > +	 * the resv object while holding the lru_lock.
> > +	 */
> > +	spin_lock(&bo->bdev->lru_lock);
> > +	bo->base.resv = &bo->base._resv;
> > +	spin_unlock(&bo->bdev->lru_lock);
> >
> >  	return r;
> >  }