✗ CI.checkpatch: warning for drm/xe: prevent UAF around preempt fence
Patchwork
patchwork at emeril.freedesktop.org
Wed Aug 14 12:17:42 UTC 2024
== Series Details ==
Series: drm/xe: prevent UAF around preempt fence
URL : https://patchwork.freedesktop.org/series/137297/
State : warning
== Summary ==
+ KERNEL=/kernel
+ git clone https://gitlab.freedesktop.org/drm/maintainer-tools mt
Cloning into 'mt'...
warning: redirecting to https://gitlab.freedesktop.org/drm/maintainer-tools.git/
+ git -C mt rev-list -n1 origin/master
9fe5037901cabbcdf27a6fe0dfb047ca1474d363
+ cd /kernel
+ git config --global --add safe.directory /kernel
+ git log -n1
commit 2c85f26453b974fda401bc6eb7a7106c03b1a872
Author: Matthew Auld <matthew.auld at intel.com>
Date: Wed Aug 14 12:01:30 2024 +0100
drm/xe: prevent UAF around preempt fence
The fence lock is part of the queue, therefore in the current design
anything locking the fence should then also hold a ref to the queue to
prevent the queue from being freed.
However, currently it looks like we signal the fence and then drop the
queue ref, but if something is waiting on the fence, the waiter is
kicked to wake up at some later point, where upon waking up it first
grabs the lock before checking the fence state. But if we have already
dropped the queue ref, then the lock might already be freed as part of
the queue, leading to uaf.
To prevent this, move the fence lock into the fence itself so we don't
run into lifetime issues. Alternative might be to have device level
lock, or only release the queue in the fence release callback, however
that might require pushing to another worker to avoid locking issues.
Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
References: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2454
References: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2342
References: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2020
Signed-off-by: Matthew Auld <matthew.auld at intel.com>
Cc: Matthew Brost <matthew.brost at intel.com>
Cc: <stable at vger.kernel.org> # v6.8+
+ /mt/dim checkpatch 95179e2efd2e2f61d5453d323fdb6e136fc15df6 drm-intel
2c85f26453b9 drm/xe: prevent UAF around preempt fence
-:23: WARNING:COMMIT_LOG_USE_LINK: Unknown link reference 'References:', use 'Link:' or 'Closes:' instead
#23:
References: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2454
-:24: WARNING:COMMIT_LOG_USE_LINK: Unknown link reference 'References:', use 'Link:' or 'Closes:' instead
#24:
References: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2342
-:25: WARNING:COMMIT_LOG_USE_LINK: Unknown link reference 'References:', use 'Link:' or 'Closes:' instead
#25:
References: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2020
total: 0 errors, 3 warnings, 0 checks, 33 lines checked
More information about the Intel-xe
mailing list