[PATCH] drm/imagination: take paired job reference

[Matt Coster]

On 18/03/2025 14:53, Brendan King via B4 Relay wrote:
> From: Brendan King <Brendan.King at imgtec.com>
> 
> For paired jobs, have the fragment job take a reference on the
> geometry job, so that the geometry job cannot be freed until
> the fragment job has finished with it.
> 
> The geometry job structure is accessed when the fragment job is being
> prepared by the GPU scheduler. Taking the reference prevents the
> geometry job being freed until the fragment job no longer requires it.
> 
> Fixes a use after free bug detected by KASAN:
> 
> [  124.256386] BUG: KASAN: slab-use-after-free in pvr_queue_prepare_job+0x108/0x868 [powervr]
> [  124.264893] Read of size 1 at addr ffff0000084cb960 by task kworker/u16:4/63
> 
> Cc: stable at vger.kernel.org
> Fixes: eaf01ee5ba28 ("drm/imagination: Implement job submission and scheduling")
> Signed-off-by: Brendan King <brendan.king at imgtec.com>

Reviewed-by: Matt Coster <matt.coster at imgtec.com>

I'll apply this to drm-misc-fixed tomorrow if there are no objections.

> ---
>  drivers/gpu/drm/imagination/pvr_job.c   | 7 +++++++
>  drivers/gpu/drm/imagination/pvr_queue.c | 4 ++++
>  2 files changed, 11 insertions(+)
> 
> diff --git a/drivers/gpu/drm/imagination/pvr_job.c b/drivers/gpu/drm/imagination/pvr_job.c
> index 1cdb3cfd058d7db573337a2b4f6895ee4922f9a9..59b334d094fa826f26668d98561e956ec9c51428 100644
> --- a/drivers/gpu/drm/imagination/pvr_job.c
> +++ b/drivers/gpu/drm/imagination/pvr_job.c
> @@ -671,6 +671,13 @@ pvr_jobs_link_geom_frag(struct pvr_job_data *job_data, u32 *job_count)
>  		geom_job->paired_job = frag_job;
>  		frag_job->paired_job = geom_job;
>  
> +		/* The geometry job pvr_job structure is used when the fragment
> +		 * job is being prepared by the GPU scheduler. Have the fragment
> +		 * job hold a reference on the geometry job to prevent it being
> +		 * freed until the fragment job has finished with it.
> +		 */
> +		pvr_job_get(geom_job);
> +
>  		/* Skip the fragment job we just paired to the geometry job. */
>  		i++;
>  	}
> diff --git a/drivers/gpu/drm/imagination/pvr_queue.c b/drivers/gpu/drm/imagination/pvr_queue.c
> index 21c185d18bb2e0569bd6e12832a74e38137bd48a..6431f6b654a2e60b86a46bd8571eb9f8133c4b53 100644
> --- a/drivers/gpu/drm/imagination/pvr_queue.c
> +++ b/drivers/gpu/drm/imagination/pvr_queue.c
> @@ -856,6 +856,10 @@ static void pvr_queue_free_job(struct drm_sched_job *sched_job)
>  	struct pvr_job *job = container_of(sched_job, struct pvr_job, base);
>  
>  	drm_sched_job_cleanup(sched_job);
> +
> +	if (job->type == DRM_PVR_JOB_TYPE_FRAGMENT && job->paired_job)
> +		pvr_job_put(job->paired_job);
> +
>  	job->paired_job = NULL;
>  	pvr_job_put(job);
>  }
> 
> ---
> base-commit: 96c85e428ebaeacd2c640eba075479ab92072ccd
> change-id: 20250318-ddkopsrc-1337-use-after-free-in-pvr_queue_prepare_job-16fbc74b0c20
> 
> Best regards,


-- 
Matt Coster
E: matt.coster at imgtec.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 236 bytes
Desc: OpenPGP digital signature
URL: <https://lists.freedesktop.org/archives/dri-devel/attachments/20250324/fec7a51e/attachment.sig>