[PATCH 3/3] drm/xe/migrate: prevent potential UAF

[Summers, Stuart]

On Wed, 2025-07-30 at 15:33 +0100, Matthew Auld wrote:
> If we hit the error path, the previous fence (if there is one) has
> already been put() prior to this, so doing a fence_wait could lead to
> UAF. Tweak the flow to do to the put() until after we do the wait.
> 
> Fixes: 270172f64b11 ("drm/xe: Update xe_ttm_access_memory to use GPU
> for non-visible access")
> Signed-off-by: Matthew Auld <matthew.auld at intel.com>
> Cc: Maciej Patelczyk <maciej.patelczyk at intel.com>
> Cc: Matthew Brost <matthew.brost at intel.com>

Reviewed-by: Stuart Summers <stuart.summers at intel.com>

> ---
>  drivers/gpu/drm/xe/xe_migrate.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_migrate.c
> b/drivers/gpu/drm/xe/xe_migrate.c
> index daca18b5b45f..bd356d9eef27 100644
> --- a/drivers/gpu/drm/xe/xe_migrate.c
> +++ b/drivers/gpu/drm/xe/xe_migrate.c
> @@ -2062,9 +2062,6 @@ int xe_migrate_access_memory(struct xe_migrate
> *m, struct xe_bo *bo,
>                         current_bytes = min_t(int, current_bytes,
> S16_MAX * pitch);
>                 }
>  
> -               if (fence)
> -                       dma_fence_put(fence);
> -
>                 __fence = xe_migrate_vram(m, current_bytes,
>                                           (unsigned long)buf &
> ~PAGE_MASK,
>                                           dma_addr + current_page,
> @@ -2072,11 +2069,15 @@ int xe_migrate_access_memory(struct
> xe_migrate *m, struct xe_bo *bo,
>                                           XE_MIGRATE_COPY_TO_VRAM :
>                                           XE_MIGRATE_COPY_TO_SRAM);
>                 if (IS_ERR(__fence)) {
> -                       if (fence)
> +                       if (fence) {
>                                 dma_fence_wait(fence, false);
> +                               dma_fence_put(fence);
> +                       }
>                         fence = __fence;
>                         goto out_err;
>                 }
> +
> +               dma_fence_put(fence);
>                 fence = __fence;
>  
>                 buf += current_bytes;