diff options
| author | Matthew Auld <matthew.auld@intel.com> | 2025-07-31 10:38:11 +0100 |
|---|---|---|
| committer | Matthew Auld <matthew.auld@intel.com> | 2025-08-07 16:59:22 +0100 |
| commit | 9b7ca35ed28fe5fad86e9d9c24ebd1271e4c9c3e (patch) | |
| tree | 30a9d3ce7768c85035d49195e2cfad46082a757d /drivers/gpu/drm | |
| parent | drm/xe/migrate: don't overflow max copy size (diff) | |
| download | linux-9b7ca35ed28fe5fad86e9d9c24ebd1271e4c9c3e.tar.gz linux-9b7ca35ed28fe5fad86e9d9c24ebd1271e4c9c3e.zip | |
drm/xe/migrate: prevent potential UAF
If we hit the error path, the previous fence (if there is one) has
already been put() prior to this, so doing a fence_wait could lead to
UAF. Tweak the flow to do to the put() until after we do the wait.
Fixes: 270172f64b11 ("drm/xe: Update xe_ttm_access_memory to use GPU for non-visible access")
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Cc: Maciej Patelczyk <maciej.patelczyk@intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: Stuart Summers <stuart.summers@intel.com>
Link: https://lore.kernel.org/r/20250731093807.207572-8-matthew.auld@intel.com
Diffstat (limited to 'drivers/gpu/drm')
| -rw-r--r-- | drivers/gpu/drm/xe/xe_migrate.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/drivers/gpu/drm/xe/xe_migrate.c b/drivers/gpu/drm/xe/xe_migrate.c index b36f5997706c..4effe10d815b 100644 --- a/drivers/gpu/drm/xe/xe_migrate.c +++ b/drivers/gpu/drm/xe/xe_migrate.c @@ -2090,9 +2090,6 @@ int xe_migrate_access_memory(struct xe_migrate *m, struct xe_bo *bo, current_bytes = min_t(int, current_bytes, S16_MAX * pitch); } - if (fence) - dma_fence_put(fence); - __fence = xe_migrate_vram(m, current_bytes, (unsigned long)buf & ~PAGE_MASK, &pagemap_addr[current_page], @@ -2100,11 +2097,15 @@ int xe_migrate_access_memory(struct xe_migrate *m, struct xe_bo *bo, XE_MIGRATE_COPY_TO_VRAM : XE_MIGRATE_COPY_TO_SRAM); if (IS_ERR(__fence)) { - if (fence) + if (fence) { dma_fence_wait(fence, false); + dma_fence_put(fence); + } fence = __fence; goto out_err; } + + dma_fence_put(fence); fence = __fence; buf += current_bytes; |