leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

drm/i915: Fix vm use-after-free in vma destruction

Browse Source 
In vma destruction, the following race may occur:

Thread 1:	    		  Thread 2:
i915_vma_destroy();

  ...
  list_del_init(vma->vm_link);
  ...
  mutex_unlock(vma->vm->mutex);
				  __i915_vm_release();
release_references();

And in release_reference() we dereference vma->vm to get to the
vm gt pointer, leading to a use-after free.

However, __i915_vm_release() grabs the vm->mutex so the vm won't be
destroyed before vma->vm->mutex is released, so extract the gt pointer
under the vm->mutex to avoid the vma->vm dereference in
release_references().

v2: Fix a typo in the commit message (Andi Shyti)

Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/5944
Fixes: e1a7ab4fca ("drm/i915: Remove the vm open count")

Cc: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com>
Cc: Matthew Auld <matthew.auld@intel.com>
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Acked-by: Nirmoy Das <nirmoy.das@intel.con>
Reviewed-by: Andrzej Hajda <andrzej.hajda@intel.com>
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20220620123659.381772-1-thomas.hellstrom@linux.intel.com
This commit is contained in:
Thomas Hellström 2022-06-20 14:36:59 +02:00
parent 99c0b3ce6c
commit 1926a6b759
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/gpu/drm/i915/i915_vma.c
View File

@ -1646,10 +1646,10 @@ static void force_unbind(struct i915_vma *vma)
GEM_BUG_ON(drm_mm_node_allocated(&vma->node)); GEM_BUG_ON(drm_mm_node_allocated(&vma->node));
} }
static void release_references(struct i915_vma *vma, bool vm_ddestroy) static void release_references(struct i915_vma *vma, struct intel_gt *gt,
bool vm_ddestroy)
{ {
struct drm_i915_gem_object *obj = vma->obj; struct drm_i915_gem_object *obj = vma->obj;
struct intel_gt *gt = vma->vm->gt;
GEM_BUG_ON(i915_vma_is_active(vma)); GEM_BUG_ON(i915_vma_is_active(vma));
@ -1704,11 +1704,12 @@ void i915_vma_destroy_locked(struct i915_vma *vma)
force_unbind(vma); force_unbind(vma);
list_del_init(&vma->vm_link); list_del_init(&vma->vm_link);
release_references(vma, false); release_references(vma, vma->vm->gt, false);
} }
void i915_vma_destroy(struct i915_vma *vma) void i915_vma_destroy(struct i915_vma *vma)
{ {
struct intel_gt *gt;
bool vm_ddestroy; bool vm_ddestroy;
mutex_lock(&vma->vm->mutex); mutex_lock(&vma->vm->mutex);
@ -1716,8 +1717,11 @@ void i915_vma_destroy(struct i915_vma *vma)
list_del_init(&vma->vm_link); list_del_init(&vma->vm_link);
vm_ddestroy = vma->vm_ddestroy; vm_ddestroy = vma->vm_ddestroy;
vma->vm_ddestroy = false; vma->vm_ddestroy = false;
/* vma->vm may be freed when releasing vma->vm->mutex. */
gt = vma->vm->gt;
mutex_unlock(&vma->vm->mutex); mutex_unlock(&vma->vm->mutex);
release_references(vma, vm_ddestroy); release_references(vma, gt, vm_ddestroy);
} }
void i915_vma_parked(struct intel_gt *gt) void i915_vma_parked(struct intel_gt *gt)