✓ CI.checkpatch: success for drm/xe: prevent potential UAF in pf_provision_vf_ggtt()
Patchwork
patchwork at emeril.freedesktop.org
Wed Aug 28 13:13:26 UTC 2024
== Series Details ==
Series: drm/xe: prevent potential UAF in pf_provision_vf_ggtt()
URL : https://patchwork.freedesktop.org/series/137906/
State : success
== Summary ==
+ KERNEL=/kernel
+ git clone https://gitlab.freedesktop.org/drm/maintainer-tools mt
Cloning into 'mt'...
warning: redirecting to https://gitlab.freedesktop.org/drm/maintainer-tools.git/
+ git -C mt rev-list -n1 origin/master
9fe5037901cabbcdf27a6fe0dfb047ca1474d363
+ cd /kernel
+ git config --global --add safe.directory /kernel
+ git log -n1
commit c3cee2c6d12a5784694776208911d063e7181951
Author: Matthew Auld <matthew.auld at intel.com>
Date: Wed Aug 28 11:43:42 2024 +0100
drm/xe: prevent potential UAF in pf_provision_vf_ggtt()
The node ptr can point to an already freed ptr, if we hit the path with
an already allocated node. We later dereference that pointer with:
xe_gt_assert(gt, !xe_ggtt_node_allocated(node));
which is a potential UAF. Fix this by not stashing the ptr for node.
Also since it is likely a bad idea to leave config->ggtt_region pointing
to a stale ptr, also set that to NULL by calling
pf_release_vf_config_ggtt() instead of pf_release_ggtt().
Fixes: 34e804220f69 ("drm/xe: Make xe_ggtt_node struct independent")
Signed-off-by: Matthew Auld <matthew.auld at intel.com>
Cc: Matthew Brost <matthew.brost at intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi at intel.com>
+ /mt/dim checkpatch 3d18c558b87ad1c2d6d59ea1c56603a01e84ab88 drm-intel
c3cee2c6d12a drm/xe: prevent potential UAF in pf_provision_vf_ggtt()
More information about the Intel-xe
mailing list