[PATCH 2/2] drm/xe/queue: move xa_alloc to prevent UAF

[Matthew Brost]

On Mon, Sep 23, 2024 at 05:09:01PM +0100, Matthew Auld wrote:
> On 23/09/2024 17:05, Matthew Brost wrote:
> > On Mon, Sep 23, 2024 at 01:57:35PM +0100, Matthew Auld wrote:
> > > Evil user can guess the next id of the queue before the ioctl completes
> > > and then call queue destroy ioctl to trigger UAF since create ioctl is
> > > still referencing the same queue. Move the xa_alloc all the way to the end
> > > to prevent this.
> > > 
> > > Fixes: 2149ded63079 ("drm/xe: Fix use after free when client stats are captured")
> > > Signed-off-by: Matthew Auld <matthew.auld at intel.com>
> > > Cc: Matthew Brost <matthew.brost at intel.com>
> > > ---
> > >   drivers/gpu/drm/xe/xe_exec_queue.c | 4 +++-
> > >   1 file changed, 3 insertions(+), 1 deletion(-)
> > > 
> > > diff --git a/drivers/gpu/drm/xe/xe_exec_queue.c b/drivers/gpu/drm/xe/xe_exec_queue.c
> > > index 7f28b7fc68d5..a1d4b9b0726e 100644
> > > --- a/drivers/gpu/drm/xe/xe_exec_queue.c
> > > +++ b/drivers/gpu/drm/xe/xe_exec_queue.c
> > > @@ -635,6 +635,9 @@ int xe_exec_queue_create_ioctl(struct drm_device *dev, void *data,
> > >   		}
> > >   	}
> > > +	q->xef = xe_file_get(xef);
> > 
> > Same comment as last patch, this looks coreect shall I merge my series
> > and then you rebase?
> 
> Yeah, sounds fine.
> 

My series is merged, feel free to rebase at your convenience.

Matt

> > 
> > Matt
> > 
> > > +
> > > +	/* user id alloc must always be last in ioctl to prevent UAF */
> > >   	mutex_lock(&xef->exec_queue.lock);
> > >   	err = xa_alloc(&xef->exec_queue.xa, &id, q, xa_limit_32b, GFP_KERNEL);
> > >   	mutex_unlock(&xef->exec_queue.lock);
> > > @@ -642,7 +645,6 @@ int xe_exec_queue_create_ioctl(struct drm_device *dev, void *data,
> > >   		goto kill_exec_queue;
> > >   	args->exec_queue_id = id;
> > > -	q->xef = xe_file_get(xef);
> > >   	return 0;
> > > -- 
> > > 2.46.1
> > >