[Intel-gfx] [PATCH] drm/i915: Prevent potential UAF in engine_init_common

[Nirmoy Das]

On 10/11/2023 2:20 PM, Jani Nikula wrote:
> On Wed, 11 Oct 2023, Nirmoy Das <nirmoy.das at intel.com> wrote:
>> If measure_breadcrumb_dw() returns an error and bce isn't created,
>> this commit ensures that intel_engine_destroy_pinned_context()
>> is not called with a NULL bce.
> So it's a potential NULL pointer dereference, not use after free like
> the subject says. Please fix the subject.

ah right. I will resend.


Thanks,

Nirmoy

>
> BR,
> Jani.
>
>
>> Fixes: b35274993680 ("drm/i915: Create a kernel context for GGTT updates")
>> Cc: Oak Zeng <oak.zeng at intel.com>
>> Cc: Andi Shyti <andi.shyti at linux.intel.com>
>> Signed-off-by: Nirmoy Das <nirmoy.das at intel.com>
>> ---
>>   drivers/gpu/drm/i915/gt/intel_engine_cs.c | 3 ++-
>>   1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
>> index 179d9546865b..4a11219e560e 100644
>> --- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c
>> +++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
>> @@ -1491,7 +1491,8 @@ static int engine_init_common(struct intel_engine_cs *engine)
>>   	return 0;
>>   
>>   err_bce_context:
>> -	intel_engine_destroy_pinned_context(bce);
>> +	if (bce)
>> +		intel_engine_destroy_pinned_context(bce);
>>   err_ce_context:
>>   	intel_engine_destroy_pinned_context(ce);
>>   	return ret;