[PATCH v4 2/5] drm/xe/svm: Fix a potential bo UAF
Thomas Hellström
thomas.hellstrom at linux.intel.com
Wed Mar 26 09:42:59 UTC 2025
On Wed, 2025-03-26 at 15:01 +0530, Ghimiray, Himal Prasad wrote:
>
>
> On 26-03-2025 13:35, Thomas Hellström wrote:
> > If drm_gpusvm_migrate_to_devmem() succeeds, if a cpu access happens
> > to the
> > range the bo may be freed before xe_bo_unlock(), causing a UAF.
> >
> > Since the reference is transferred, use xe_svm_devmem_release() to
> > release the reference on drm_gpusvm_migrate_to_devmem() failure,
> > and hold a local reference to protect the UAF.
>
> Fixes tag ?
Right. Will add that.
Thanks,
Thomas
>
> >
> > Signed-off-by: Thomas Hellström <thomas.hellstrom at linux.intel.com>
> > Reviewed-by: Matthew Brost <matthew.brost at intel.com>
> > ---
> > drivers/gpu/drm/xe/xe_svm.c | 7 +++++--
> > 1 file changed, 5 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/gpu/drm/xe/xe_svm.c
> > b/drivers/gpu/drm/xe/xe_svm.c
> > index 52613dd8573a..c7424c824a14 100644
> > --- a/drivers/gpu/drm/xe/xe_svm.c
> > +++ b/drivers/gpu/drm/xe/xe_svm.c
> > @@ -702,11 +702,14 @@ static int xe_svm_alloc_vram(struct xe_vm
> > *vm, struct xe_tile *tile,
> > list_for_each_entry(block, blocks, link)
> > block->private = vr;
> >
> > + xe_bo_get(bo);
> > err = drm_gpusvm_migrate_to_devmem(&vm->svm.gpusvm,
> > &range->base,
> > &bo->devmem_allocation,
> > ctx);
> > - xe_bo_unlock(bo);
> > if (err)
> > - xe_bo_put(bo); /* Creation ref */
> > + xe_svm_devmem_release(&bo->devmem_allocation);
> > +
> > + xe_bo_unlock(bo);
> > + xe_bo_put(bo);
> >
> > unlock:
> > mmap_read_unlock(mm);
>
More information about the Intel-xe
mailing list