Unverified Commit 9e7f3056 authored by Matthew Brost's avatar Matthew Brost Committed by Rodrigo Vivi
Browse files

drm/xe: Free job before xe_exec_queue_put 



Free job depends on job->vm being valid, the last xe_exec_queue_put can
destroy the VM. Prevent UAF by freeing job before xe_exec_queue_put.

Fixes: dd08ebf6 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Signed-off-by: default avatarMatthew Brost <matthew.brost@intel.com>
Reviewed-by: default avatarNirmoy Das <nirmoy.das@intel.com>
Reviewed-by: default avatarJagmeet Randhawa <jagmeet.randhawa@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240820202309.1260755-1-matthew.brost@intel.com


(cherry picked from commit 32a42c93)
Signed-off-by: default avatarRodrigo Vivi <rodrigo.vivi@intel.com>
parent dd3e840a

drivers/gpu/drm/xe/xe_sched_job.c

+2 −1
Original line number Diff line number Diff line
@@ -171,12 +171,13 @@ void xe_sched_job_destroy(struct kref *ref) 
	struct xe_sched_job *job =

		container_of(ref, struct xe_sched_job, refcount);

	struct xe_device *xe = job_to_xe(job);

	struct xe_exec_queue *q = job->q;



	xe_sched_job_free_fences(job);

	xe_exec_queue_put(job->q);

	dma_fence_put(job->fence);

	drm_sched_job_cleanup(&job->drm);

	job_free(job);

	xe_exec_queue_put(q);

	xe_pm_runtime_put(xe);

}