✓ CI.checkpatch: success for drm/xe: prevent potential UAF in pf_provision_vf_ggtt()

Patchwork patchwork at emeril.freedesktop.org
Wed Aug 28 13:13:26 UTC 2024


== Series Details ==

Series: drm/xe: prevent potential UAF in pf_provision_vf_ggtt()
URL   : https://patchwork.freedesktop.org/series/137906/
State : success

== Summary ==

+ KERNEL=/kernel
+ git clone https://gitlab.freedesktop.org/drm/maintainer-tools mt
Cloning into 'mt'...
warning: redirecting to https://gitlab.freedesktop.org/drm/maintainer-tools.git/
+ git -C mt rev-list -n1 origin/master
9fe5037901cabbcdf27a6fe0dfb047ca1474d363
+ cd /kernel
+ git config --global --add safe.directory /kernel
+ git log -n1
commit c3cee2c6d12a5784694776208911d063e7181951
Author: Matthew Auld <matthew.auld at intel.com>
Date:   Wed Aug 28 11:43:42 2024 +0100

    drm/xe: prevent potential UAF in pf_provision_vf_ggtt()
    
    The node ptr can point to an already freed ptr, if we hit the path with
    an already allocated node. We later dereference that pointer with:
    
            xe_gt_assert(gt, !xe_ggtt_node_allocated(node));
    
    which is a potential UAF. Fix this by not stashing the ptr for node.
    Also since it is likely a bad idea to leave config->ggtt_region pointing
    to a stale ptr, also set that to NULL by calling
    pf_release_vf_config_ggtt() instead of pf_release_ggtt().
    
    Fixes: 34e804220f69 ("drm/xe: Make xe_ggtt_node struct independent")
    Signed-off-by: Matthew Auld <matthew.auld at intel.com>
    Cc: Matthew Brost <matthew.brost at intel.com>
    Cc: Rodrigo Vivi <rodrigo.vivi at intel.com>
+ /mt/dim checkpatch 3d18c558b87ad1c2d6d59ea1c56603a01e84ab88 drm-intel
c3cee2c6d12a drm/xe: prevent potential UAF in pf_provision_vf_ggtt()




More information about the Intel-xe mailing list