[PATCH v2] drm/xe: Fix possible UAF in guc_exec_queue_process_msg

[Matthew Brost]

On Wed, Jul 24, 2024 at 09:42:11AM -0600, Upadhyay, Tejas wrote:
> 
> 
> > -----Original Message-----
> > From: Intel-xe <intel-xe-bounces at lists.freedesktop.org> On Behalf Of
> > Matthew Brost
> > Sent: Wednesday, July 24, 2024 12:49 AM
> > To: intel-xe at lists.freedesktop.org
> > Cc: dan.carpenter at linaro.org
> > Subject: [PATCH v2] drm/xe: Fix possible UAF in
> > guc_exec_queue_process_msg
> > 
> > Store xe_device ahead of processing message as message can be free'd in
> > some cases.
> > 
> > v2:
> >  - Including missing local changes
> > 
> > Reported-by: kernel test robot <lkp at intel.com>
> > Reported-by: Dan Carpenter <dan.carpenter at linaro.org>
> > Closes: https://lore.kernel.org/r/202407231445.rpisd1vA-lkp@intel.com/
> > Fixes: d930c19fdff3 ("drm/xe: Build PM into GuC CT layer")
> > Signed-off-by: Matthew Brost <matthew.brost at intel.com>
> > ---
> >  drivers/gpu/drm/xe/xe_guc_submit.c | 4 +++-
> >  1 file changed, 3 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c
> > b/drivers/gpu/drm/xe/xe_guc_submit.c
> > index da2ead86b9ae..b8f938539a90 100644
> > --- a/drivers/gpu/drm/xe/xe_guc_submit.c
> > +++ b/drivers/gpu/drm/xe/xe_guc_submit.c
> > @@ -1395,6 +1395,8 @@ static void
> > __guc_exec_queue_process_msg_resume(struct xe_sched_msg *msg)
> > 
> >  static void guc_exec_queue_process_msg(struct xe_sched_msg *msg)  {
> > +	struct xe_device *xe =
> > +guc_to_xe(exec_queue_to_guc(msg->private_data));
> 
> If msg freed at this point, don't you need to protect against NULL, just in case?
> 

The msg is valid here, it can be freed in the below swicth statement
hence the bug in referencing it after the switch statement.

Matt

> Thanks,
> Tejas
> > +
> >  	trace_xe_sched_msg_recv(msg);
> > 
> >  	switch (msg->opcode) {
> > @@ -1414,7 +1416,7 @@ static void guc_exec_queue_process_msg(struct
> > xe_sched_msg *msg)
> >  		XE_WARN_ON("Unknown message type");
> >  	}
> > 
> > -	xe_pm_runtime_put(guc_to_xe(exec_queue_to_guc(msg-
> > >private_data)));
> > +	xe_pm_runtime_put(xe);
> >  }
> > 
> >  static const struct drm_sched_backend_ops drm_sched_ops = {
> > --
> > 2.34.1
>