✓ CI.checkpatch: success for drm/xe/vm: prevent UAF in rebind_work_func()

Patchwork patchwork at emeril.freedesktop.org
Wed Apr 17 17:28:55 UTC 2024


== Series Details ==

Series: drm/xe/vm: prevent UAF in rebind_work_func()
URL   : https://patchwork.freedesktop.org/series/132571/
State : success

== Summary ==

+ KERNEL=/kernel
+ git clone https://gitlab.freedesktop.org/drm/maintainer-tools mt
Cloning into 'mt'...
warning: redirecting to https://gitlab.freedesktop.org/drm/maintainer-tools.git/
+ git -C mt rev-list -n1 origin/master
f5fb02e01091a469b6325b72a47b3a0a1e96309c
+ cd /kernel
+ git config --global --add safe.directory /kernel
+ git log -n1
commit ab31e8462d276b92d43188e83fae015e388f7f74
Author: Matthew Auld <matthew.auld at intel.com>
Date:   Wed Apr 17 17:31:08 2024 +0100

    drm/xe/vm: prevent UAF in rebind_work_func()
    
    We flush the rebind worker during the vm close phase, however in places
    like preempt_fence_work_func() we seem to queue the rebind worker
    without first checking if the vm has already been closed.  The concern
    here is the vm being closed with the worker flushed, but then being
    rearmed later, which looks like potential uaf, since there is no actual
    refcounting to track the queued worker. To ensure this can't happen
    prevent queueing the rebind worker once the vm has been closed.
    
    Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
    Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/1591
    Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/1304
    Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/1249
    Signed-off-by: Matthew Auld <matthew.auld at intel.com>
    Cc: Matthew Brost <matthew.brost at intel.com>
    Cc: <stable at vger.kernel.org> # v6.8+
+ /mt/dim checkpatch 64a20aacb61e4ce6d8a0b3dc6e4bff72e316ffa3 drm-intel
ab31e8462d27 drm/xe/vm: prevent UAF in rebind_work_func()




More information about the Intel-xe mailing list