[PATCH 2/5] drm/xe/svm: Fix a potential bo UAF

[Matthew Brost]

On Mon, Mar 17, 2025 at 11:41:29AM +0100, Thomas Hellström wrote:
> If drm_gpusvm_migrate_to_devmem() succeeds, if a cpu access happens to the
> range the bo may be freed before xe_bo_unlock(), causing a UAF.
> 
> Since the reference is transferred, use xe_svm_devmem_release() to
> release the reference on drm_gpusvm_migrate_to_devmem() failure,
> and hold a local reference to protect the UAF.
> 
> Signed-off-by: Thomas Hellström <thomas.hellstrom at linux.intel.com>

Reviewed-by: Matthew Brost <matthew.brost at intel.com>

> ---
>  drivers/gpu/drm/xe/xe_svm.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_svm.c b/drivers/gpu/drm/xe/xe_svm.c
> index c305d4c351d7..1a8e17a0005d 100644
> --- a/drivers/gpu/drm/xe/xe_svm.c
> +++ b/drivers/gpu/drm/xe/xe_svm.c
> @@ -701,11 +701,14 @@ static int xe_svm_alloc_vram(struct xe_vm *vm, struct xe_tile *tile,
>  	list_for_each_entry(block, blocks, link)
>  		block->private = vr;
>  
> +	xe_bo_get(bo);
>  	err = drm_gpusvm_migrate_to_devmem(&vm->svm.gpusvm, &range->base,
>  					   &bo->devmem_allocation, ctx);
> -	xe_bo_unlock(bo);
>  	if (err)
> -		xe_bo_put(bo);	/* Creation ref */
> +		xe_svm_devmem_release(&bo->devmem_allocation);
> +
> +	xe_bo_unlock(bo);
> +	xe_bo_put(bo);
>  
>  unlock:
>  	mmap_read_unlock(mm);
> -- 
> 2.48.1
>