Unverified Commit 145832fb authored by Matthew Auld's avatar Matthew Auld Committed by Rodrigo Vivi
Browse files

drm/xe/migrate: prevent potential UAF 



If we hit the error path, the previous fence (if there is one) has
already been put() prior to this, so doing a fence_wait could lead to
UAF. Tweak the flow to do to the put() until after we do the wait.

Fixes: 270172f6 ("drm/xe: Update xe_ttm_access_memory to use GPU for non-visible access")
Signed-off-by: default avatarMatthew Auld <matthew.auld@intel.com>
Cc: Maciej Patelczyk <maciej.patelczyk@intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: default avatarStuart Summers <stuart.summers@intel.com>
Link: https://lore.kernel.org/r/20250731093807.207572-8-matthew.auld@intel.com


(cherry picked from commit 9b7ca35e)
Signed-off-by: default avatarRodrigo Vivi <rodrigo.vivi@intel.com>
parent 4126cb32

drivers/gpu/drm/xe/xe_migrate.c

+5 −4
Original line number Diff line number Diff line
@@ -1893,9 +1893,6 @@ int xe_migrate_access_memory(struct xe_migrate *m, struct xe_bo *bo, 
			current_bytes = min_t(int, current_bytes, S16_MAX * pitch);

		}



		if (fence)

			dma_fence_put(fence);



		__fence = xe_migrate_vram(m, current_bytes,

					  (unsigned long)buf & ~PAGE_MASK,

					  dma_addr + current_page,
@@ -1903,11 +1900,15 @@ int xe_migrate_access_memory(struct xe_migrate *m, struct xe_bo *bo, 
					  XE_MIGRATE_COPY_TO_VRAM :

					  XE_MIGRATE_COPY_TO_SRAM);

		if (IS_ERR(__fence)) {

			if (fence)

			if (fence) {

				dma_fence_wait(fence, false);

				dma_fence_put(fence);

			}

			fence = __fence;

			goto out_err;

		}



		dma_fence_put(fence);

		fence = __fence;



		buf += current_bytes;