diff options
| author | Matthew Auld <matthew.auld@intel.com> | 2024-04-12 12:31:45 +0100 |
|---|---|---|
| committer | Lucas De Marchi <lucas.demarchi@intel.com> | 2024-04-17 08:03:13 -0500 |
| commit | ca7c52ac7ad384bcf299d89482c45fec7cd00da9 (patch) | |
| tree | 10a9a5828918ba85edacb318786c72431845836e /drivers/nvmem/layouts.c | |
| parent | 652ead9b746a63e4e79d7ad66d3edf0a8a5b0c2f (diff) | |
| download | linux-stable-ca7c52ac7ad384bcf299d89482c45fec7cd00da9.tar.gz linux-stable-ca7c52ac7ad384bcf299d89482c45fec7cd00da9.tar.bz2 linux-stable-ca7c52ac7ad384bcf299d89482c45fec7cd00da9.zip | |
drm/xe/vm: prevent UAF with asid based lookup
The asid is only erased from the xarray when the vm refcount reaches
zero, however this leads to potential UAF since the xe_vm_get() only
works on a vm with refcount != 0. Since the asid is allocated in the vm
create ioctl, rather erase it when closing the vm, prior to dropping the
potential last ref. This should also work when user closes driver fd
without explicit vm destroy.
Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/1594
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: <stable@vger.kernel.org> # v6.8+
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240412113144.259426-4-matthew.auld@intel.com
(cherry picked from commit 83967c57320d0d01ae512f10e79213f81e4bf594)
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
Diffstat (limited to 'drivers/nvmem/layouts.c')
0 files changed, 0 insertions, 0 deletions