Commit c9db07ca authored by Thomas Hellström's avatar Thomas Hellström
Browse files

drm/xe/svm: Fix a potential bo UAF 



If drm_gpusvm_migrate_to_devmem() succeeds, if a cpu access happens to the
range the bo may be freed before xe_bo_unlock(), causing a UAF.

Since the reference is transferred, use xe_svm_devmem_release() to
release the reference on drm_gpusvm_migrate_to_devmem() failure,
and hold a local reference to protect the UAF.

Fixes: 2f118c94 ("drm/xe: Add SVM VRAM migration")
Signed-off-by: default avatarThomas Hellström <thomas.hellstrom@linux.intel.com>
Reviewed-by: default avatarMatthew Brost <matthew.brost@intel.com>
Link: https://lore.kernel.org/r/20250326080551.40201-3-thomas.hellstrom@linux.intel.com
parent 6c55404d

drivers/gpu/drm/xe/xe_svm.c

+5 −2
Original line number Diff line number Diff line
@@ -702,11 +702,14 @@ static int xe_svm_alloc_vram(struct xe_vm *vm, struct xe_tile *tile, 
	list_for_each_entry(block, blocks, link)

		block->private = vr;



	xe_bo_get(bo);

	err = drm_gpusvm_migrate_to_devmem(&vm->svm.gpusvm, &range->base,

					   &bo->devmem_allocation, ctx);

	xe_bo_unlock(bo);

	if (err)

		xe_bo_put(bo);	/* Creation ref */

		xe_svm_devmem_release(&bo->devmem_allocation);



	xe_bo_unlock(bo);

	xe_bo_put(bo);



unlock:

	mmap_read_unlock(mm);