leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Files
4a7fb1c67ef4242100a1a875c19bef2cb846b5ce
linux/drivers/gpu/drm/i915
History
Thomas Hellström 12058077b2 drm/i915: Fix vm use-after-free in vma destruction 
In vma destruction, the following race may occur:

Thread 1:	    		  Thread 2:
i915_vma_destroy();

  ...
  list_del_init(vma->vm_link);
  ...
  mutex_unlock(vma->vm->mutex);
				  __i915_vm_release();
release_references();

And in release_reference() we dereference vma->vm to get to the
vm gt pointer, leading to a use-after free.

However, __i915_vm_release() grabs the vm->mutex so the vm won't be
destroyed before vma->vm->mutex is released, so extract the gt pointer
under the vm->mutex to avoid the vma->vm dereference in
release_references().

v2: Fix a typo in the commit message (Andi Shyti)

Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/5944
Fixes: e1a7ab4fca ("drm/i915: Remove the vm open count")

Cc: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com>
Cc: Matthew Auld <matthew.auld@intel.com>
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Acked-by: Nirmoy Das <nirmoy.das@intel.con>
Reviewed-by: Andrzej Hajda <andrzej.hajda@intel.com>
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20220620123659.381772-1-thomas.hellstrom@linux.intel.com
(cherry picked from commit 1926a6b759)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2022-07-06 23:04:55 -04:00
..
display
drm/i915: fix a possible refcount leak in intel_dp_add_mst_connector()
2022-07-06 23:04:43 -04:00
gem
drm/i915: tweak the ordering in cpu_write_needs_clflush
2022-06-27 18:12:10 +03:00
gt
drm/i915/guc: ADL-N should use the same GuC FW as ADL-S
2022-07-06 23:04:47 -04:00
gvt
Merge tag 'vfio-v5.19-rc1' of https://github.com/awilliam/linux-vfio
2022-06-01 13:49:15 -07:00
pxp
drm/i915: include uapi/drm/i915_drm.h directly where needed
2022-03-17 20:06:04 +02:00
selftests
Merge tag 'drm-intel-gt-next-2022-04-27' of git://anongit.freedesktop.org/drm/drm-intel into drm-next
2022-04-28 15:32:29 +10:00
.gitignore
…
i915_active_types.h
drm/i915/active: remove useless i915_utils.h include
2021-12-13 12:04:44 +02:00
i915_active.c
drm/i915: Remove unused bits of i915_vma/active api
2021-12-20 16:26:09 +01:00
i915_active.h
drm/i915: Remove unused bits of i915_vma/active api
2021-12-20 16:26:09 +01:00
i915_cmd_parser.c
drm/i915: include linux/highmem.h and linux/swap.h where needed
2022-03-04 11:15:25 +02:00
i915_cmd_parser.h
drm/i915: split out i915_cmd_parser.h from i915_drv.h
2022-01-10 15:43:09 +02:00
i915_config.c
drm/i915: remove IS_ACTIVE
2021-10-07 11:04:05 -07:00
i915_debugfs_params.c
drm/i915: Use to_gt() helper
2021-12-17 21:51:59 -08:00
i915_debugfs_params.h
…
i915_debugfs.c
Merge drm/drm-next into drm-intel-gt-next
2022-04-21 13:48:26 -04:00
i915_debugfs.h
…
i915_deps.c
drm/i915: fix broken build
2022-04-08 10:36:11 +02:00
i915_deps.h
drm/i915: Break out the i915_deps utility
2021-12-22 08:52:57 +01:00
i915_driver.c
drm/i915/dgfx: Disable d3cold at gfx root port
2022-06-27 18:12:05 +03:00
i915_driver.h
drm/i915: Move intel_vtd_active and run_as_guest to i915_utils
2022-03-30 12:04:01 +01:00
i915_drm_client.c
drm/i915/fdinfo: Don't show engine classes not present
2022-06-20 13:07:49 +03:00
i915_drm_client.h
drm/i915/xehp: Add compute engine ABI
2022-04-29 14:30:27 -07:00
i915_drv.h
Merge tag 'drm-intel-next-2022-05-06' of git://anongit.freedesktop.org/drm/drm-intel into drm-next
2022-05-11 11:00:15 +10:00
i915_file_private.h
drm/i915: Explicitly track DRM clients
2022-04-05 08:38:49 +01:00
i915_fixed.h
…
i915_gem_evict.c
Merge tag 'drm-intel-gt-next-2022-02-17' of git://anongit.freedesktop.org/drm/drm-intel into drm-intel-next
2022-02-23 15:03:51 -05:00
i915_gem_evict.h
Merge tag 'drm-intel-gt-next-2022-02-17' of git://anongit.freedesktop.org/drm/drm-intel into drm-intel-next
2022-02-23 15:03:51 -05:00
i915_gem_gtt.c
Merge tag 'drm-intel-gt-next-2022-02-17' of git://anongit.freedesktop.org/drm/drm-intel into drm-intel-next
2022-02-23 15:03:51 -05:00
i915_gem_gtt.h
drm/i915: Remove short-term pins from execbuf, v6.
2022-01-18 12:19:30 +01:00
i915_gem_ww.c
drm/i915: Break out dma_resv ww locking utilities to separate files
2021-06-17 14:22:59 +01:00
i915_gem_ww.h
drm/i915: Ditch the i915_gem_ww_ctx loop member
2021-08-20 09:39:41 +01:00
i915_gem.c
drm/i915: Explicitly track DRM clients
2022-04-05 08:38:49 +01:00
i915_gem.h
drm/i915: Break out dma_resv ww locking utilities to separate files
2021-06-17 14:22:59 +01:00
i915_getparam.c
Merge tag 'drm-intel-gt-next-2022-02-17' of git://anongit.freedesktop.org/drm/drm-intel into drm-intel-next
2022-02-23 15:03:51 -05:00
i915_getparam.h
drm/i915: split out i915_getparam.h from i915_drv.h
2022-01-10 15:43:05 +02:00
i915_gpu_error.c
Merge drm/drm-next into drm-intel-gt-next
2022-04-21 13:48:26 -04:00
i915_gpu_error.h
Merge drm/drm-next into drm-intel-gt-next
2022-04-21 13:48:26 -04:00
i915_ioc32.c
drm/i915: split out i915_getparam.h from i915_drv.h
2022-01-10 15:43:05 +02:00
i915_ioc32.h
…
i915_ioctl.c
drm/i915: split out i915_reg_read_ioctl() to i915_ioctl.[ch]
2022-01-21 09:59:22 +02:00
i915_ioctl.h
drm/i915: split out i915_reg_read_ioctl() to i915_ioctl.[ch]
2022-01-21 09:59:22 +02:00
i915_iosf_mbi.h
drm/i915: abstraction for iosf to compile on all archs
2021-10-27 00:32:01 -07:00
i915_irq.c
drm/i915/reg: split out icl_dsi_regs.h
2022-02-21 12:06:15 +02:00
i915_irq.h
drm/i915/hpd: hide struct intel_hotplug_funcs
2022-02-09 13:39:35 +02:00
i915_memcpy.c
drm/i915: Move cmd parser pinning to execbuffer
2021-03-24 11:39:59 +01:00
i915_memcpy.h
drm/i915: Move cmd parser pinning to execbuffer
2021-03-24 11:39:59 +01:00
i915_mitigations.c
drm/i915: move the DRIVER_* macros to i915_driver.[ch]
2022-02-10 11:44:25 +02:00
i915_mitigations.h
…
i915_mm.c
drm/i915: Skip remap_io_mapping() for non-x86 platforms
2021-12-08 13:26:14 -08:00
i915_mm.h
drm/i915: Fix header test for !CONFIG_X86
2022-02-07 12:56:49 +00:00
i915_module.c
Merge tag 'drm-intel-gt-next-2022-02-17' of git://anongit.freedesktop.org/drm/drm-intel into drm-intel-next
2022-02-23 15:03:51 -05:00
i915_params.c
Merge drm/drm-next into drm-intel-gt-next
2022-04-21 13:48:26 -04:00
i915_params.h
drm/i915: add lmem_size modparam
2022-03-28 09:06:29 +01:00
i915_pci.c
Merge tag 'drm-intel-next-2022-05-06' of git://anongit.freedesktop.org/drm/drm-intel into drm-next
2022-05-11 11:00:15 +10:00
i915_pci.h
drm/i915/pci: rename functions to have i915_pci prefix
2021-08-26 10:50:19 +03:00
i915_perf_oa_regs.h
drm/i915/perf: Express OA register ranges with i915_range
2022-02-02 07:52:23 -08:00
i915_perf_types.h
drm/i915: Fix CFI violation with show_dynamic_id()
2022-05-19 12:10:57 +03:00
i915_perf.c
drm/i915: Fix CFI violation with show_dynamic_id()
2022-05-19 12:10:57 +03:00
i915_perf.h
drm/i915: Use a table for i915_init/exit (v2)
2021-07-22 12:05:17 +02:00
i915_pmu.c
Merge tag 'bitmap-for-5.19-rc1' of https://github.com/norov/linux
2022-06-04 14:04:27 -07:00
i915_pmu.h
drm/i915: Use a table for i915_init/exit (v2)
2021-07-22 12:05:17 +02:00
i915_priolist_types.h
drm/i915: Remove I915_USER_PRIORITY_SHIFT
2021-03-24 19:30:34 +01:00
i915_pvinfo.h
…
i915_query.c
drm/i915/uapi: Add DRM_I915_QUERY_GEOMETRY_SUBSLICES
2022-04-15 08:00:55 -07:00
i915_query.h
…
i915_reg_defs.h
drm/i915/gt: Remove GEN12_SFC_DONE_MAX from register defs header
2022-03-11 08:18:27 -08:00
i915_reg.h
drm/i915/reg: fix undefined behavior due to shift overflowing the constant
2022-05-19 12:50:29 +03:00
i915_request.c
dma-buf: add enum dma_resv_usage v4
2022-04-07 12:53:53 +02:00
i915_request.h
drm/i915: Use struct vma_resource instead of struct vma_snapshot
2022-01-11 10:54:11 +01:00
i915_scatterlist.c
drm: move the buddy allocator from i915 into common drm
2022-01-19 08:17:07 +01:00
i915_scatterlist.h
drm/i915: Introduce refcounted sg-tables
2021-11-01 18:10:49 +01:00
i915_scheduler_types.h
drm/i915/guc: Implement GuC priority management
2021-07-27 17:32:27 -07:00
i915_scheduler.c
drm/i915: move scheduler slabs to direct module init/exit
2021-07-28 17:18:56 +02:00
i915_scheduler.h
drm/i915: move scheduler slabs to direct module init/exit
2021-07-28 17:18:56 +02:00
i915_selftest.h
drm/i915: Pin timeline map after first timeline pin, v4.
2021-03-24 11:39:46 +01:00
i915_suspend.c
drm/i915/fbc: Remove intel_fbc_global_disable()
2022-04-13 17:19:04 +03:00
i915_suspend.h
…
i915_sw_fence_work.c
drm/i915: Drop stealing of bits from i915_sw_fence function pointer
2021-11-30 17:52:15 -08:00
i915_sw_fence_work.h
drm/i915: Drop error handling from dma_fence_work
2021-07-16 21:47:39 +02:00
i915_sw_fence.c
dma-buf: add enum dma_resv_usage v4
2022-04-07 12:53:53 +02:00
i915_sw_fence.h
drm/i915: Drop stealing of bits from i915_sw_fence function pointer
2021-11-30 17:52:15 -08:00
i915_switcheroo.c
drm/i915/driver: add i915_driver_ prefix to functions
2021-11-17 11:47:55 +02:00
i915_switcheroo.h
…
i915_syncmap.c
…
i915_syncmap.h
…
i915_sysfs.c
drm/i915/gt: Fix memory leaks in per-gt sysfs
2022-06-13 13:04:31 +03:00
i915_sysfs.h
drm/i915/gt: create per-tile sysfs interface
2022-03-21 08:37:39 +00:00
i915_trace_points.c
…
i915_trace.h
drm/i915/trace: split out display trace to a separate file
2021-12-09 11:21:46 +02:00
i915_ttm_buddy_manager.c
drm/i915/buddy: sanity check the size
2022-04-21 10:10:35 +01:00
i915_ttm_buddy_manager.h
drm/i915/selftests: exercise mmap migration
2022-03-01 08:50:48 +00:00
i915_user_extensions.c
…
i915_user_extensions.h
…
i915_utils.c
drm/i915: Move intel_vtd_active and run_as_guest to i915_utils
2022-03-30 12:04:01 +01:00
i915_utils.h
drm/i915: Split i915_run_as_guest into x86 and non-x86
2022-04-06 09:02:37 -07:00
i915_vgpu.c
drm/i915: Add object locking to i915_gem_evict_for_node and i915_gem_evict_something, v2.
2022-01-18 12:18:03 +01:00
i915_vgpu.h
…
i915_vma_resource.c
drm/i915: Remove the vm open count
2022-03-07 08:50:03 +01:00
i915_vma_resource.h
drm/i915: Remove the vm open count
2022-03-07 08:50:03 +01:00
i915_vma_types.h
drm/i915: Remove the vma refcount
2022-03-07 08:50:52 +01:00
i915_vma.c
drm/i915: Fix vm use-after-free in vma destruction
2022-07-06 23:04:55 -04:00
i915_vma.h
drm/i915: use IOMEM_ERR_PTR() directly
2022-05-04 13:10:49 +01:00
intel_device_info.c
Merge tag 'drm-intel-next-2022-05-06' of git://anongit.freedesktop.org/drm/drm-intel into drm-next
2022-05-11 11:00:15 +10:00
intel_device_info.h
Merge tag 'drm-intel-next-2022-05-06' of git://anongit.freedesktop.org/drm/drm-intel into drm-next
2022-05-11 11:00:15 +10:00
intel_dram.c
drm/i915: Use str_yes_no()
2022-03-02 08:48:13 -08:00
intel_dram.h
…
intel_gvt_mmio_table.c
Merge tag 'gvt-next-2022-04-21-for-christoph' of https://github.com/intel/gvt-linux into drm-intel-next
2022-04-25 11:20:57 +03:00
intel_gvt.c
drm/i915/gvt: Fix the compiling error when CONFIG_DRM_I915_DEBUG_RUNTIME_PM=n
2022-04-28 17:01:17 -04:00
intel_gvt.h
drm/i915/gvt: move the gvt code into kvmgt.ko
2022-04-21 07:36:56 -04:00
intel_mchbar_regs.h
drm/i915: Clean up SSKPD/MLTR defines
2022-02-18 08:42:17 +02:00
intel_memory_region.c
Merge drm/drm-next into drm-intel-gt-next
2022-04-21 13:48:26 -04:00
intel_memory_region.h
Merge drm/drm-next into drm-intel-gt-next
2022-04-21 13:48:26 -04:00
intel_pch.c
drm/i915: Move intel_vtd_active and run_as_guest to i915_utils
2022-03-30 12:04:01 +01:00
intel_pch.h
Merge tag 'drm-next-2022-03-24' of git://anongit.freedesktop.org/drm/drm
2022-03-24 16:19:43 -07:00
intel_pci_config.h
drm/i915: split out PCI config space registers from i915_reg.h
2022-01-10 16:17:46 +02:00
intel_pcode.c
drm/i915: Swap ret and status returned from skl_pcode_request
2022-04-11 16:47:08 +03:00
intel_pcode.h
drm/i915/pcode: rename sandybridge_pcode_* to snb_pcode_*
2022-01-13 15:20:57 +02:00
intel_pm_types.h
drm/i915: split out intel_pm_types.h
2021-12-03 11:28:12 +02:00
intel_pm.c
Merge tag 'drm-next-2022-05-25' of git://anongit.freedesktop.org/drm/drm
2022-05-25 16:18:27 -07:00
intel_pm.h
drm/i915/display/adlp: Fix programing of PIPE_MBUS_DBOX_CTL
2022-03-30 13:34:46 -07:00
intel_region_ttm.c
drm/i915/ttm: wire up the object offset
2022-03-16 17:50:38 +00:00
intel_region_ttm.h
drm/i915/ttm: wire up the object offset
2022-03-16 17:50:38 +00:00
intel_runtime_pm.c
drm/i915/selftests: Disable runtime pm wakeref tracking for the mock device
2022-02-11 13:22:10 +02:00
intel_runtime_pm.h
drm/i915/selftests: Disable runtime pm wakeref tracking for the mock device
2022-02-11 13:22:10 +02:00
intel_sbi.c
drm/i915: Only include i915_reg.h from .c files
2022-02-02 07:59:54 -08:00
intel_sbi.h
drm/i915: rename intel_sideband.[ch] to intel_sbi.[ch]
2021-10-14 18:05:04 +03:00
intel_step.c
Merge drm/drm-next into drm-intel-next
2022-04-11 16:01:56 +03:00
intel_step.h
drm/i915: Rename GT_STEP to GRAPHICS_STEP
2021-11-02 13:05:40 -07:00
intel_uncore.c
Merge drm/drm-next into drm-intel-gt-next
2022-04-21 13:48:26 -04:00
intel_uncore.h
drm/i915: Prepare for multiple GTs
2022-03-21 08:37:36 +00:00
intel_wakeref.c
…
intel_wakeref.h
drm/i915/guc: Take engine PM when a context is pinned with GuC submission
2021-10-15 10:37:26 -07:00
intel_wopcm.c
drm/i915/wopcm: Handle pre-programmed WOPCM registers
2022-01-26 11:47:24 -08:00
intel_wopcm.h
…
Kconfig
Merge tag 'drm-intel-next-2022-05-06' of git://anongit.freedesktop.org/drm/drm-intel into drm-next
2022-05-11 11:00:15 +10:00
Kconfig.debug
drm/i915: Improve debug Kconfig texts a bit
2021-07-06 10:10:07 +02:00
Kconfig.profile
drm/i915: Fail too long user submissions by default
2021-03-26 01:01:27 +01:00
Kconfig.unstable
drm/i915: Kill the fake lmem support
2022-02-18 22:31:46 -08:00
Makefile
Merge tag 'drm-intel-next-2022-05-06' of git://anongit.freedesktop.org/drm/drm-intel into drm-next
2022-05-11 11:00:15 +10:00
TODO.txt
drm/i915: add gem/gt TODO
2021-03-26 09:24:31 +01:00
vlv_sideband_reg.h
drm/i915: split out vlv sideband registers from i915_reg.h
2022-01-10 16:17:50 +02:00
vlv_sideband.c
drm/i915: Only include i915_reg.h from .c files
2022-02-02 07:59:54 -08:00
vlv_sideband.h
drm/i915: split out vlv sideband registers from i915_reg.h
2022-01-10 16:17:50 +02:00
vlv_suspend.c
drm/i915: Use str_on_off()
2022-03-02 08:48:23 -08:00
vlv_suspend.h
…