diff options
| author |   Thomas Hellström <thomas.hellstrom@linux.intel.com> | 2025-03-26 09:05:48 +0100 |
|---|---|---|
| committer |   Lucas De Marchi <lucas.demarchi@intel.com> | 2025-04-07 13:16:06 -0700 |
| commit | 1d8c0557927e6d69cb6341b7792f882412cfccff (patch) | |
| tree | 9d523072c31d465bc4ecdec99db31276fd7b7dec /scripts/lib/kdoc/kdoc_files.py | |
| parent | drm/xe/bmg: Add one additional PCI ID (diff) | |
| download | linux-rng-1d8c0557927e6d69cb6341b7792f882412cfccff.tar.xz linux-rng-1d8c0557927e6d69cb6341b7792f882412cfccff.zip | |
drm/xe/svm: Fix a potential bo UAF
If drm_gpusvm_migrate_to_devmem() succeeds, if a cpu access happens to the
range the bo may be freed before xe_bo_unlock(), causing a UAF.
Since the reference is transferred, use xe_svm_devmem_release() to
release the reference on drm_gpusvm_migrate_to_devmem() failure,
and hold a local reference to protect the UAF.
Fixes: 2f118c949160 ("drm/xe: Add SVM VRAM migration")
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://lore.kernel.org/r/20250326080551.40201-3-thomas.hellstrom@linux.intel.com
(cherry picked from commit c9db07cab766b665c8fa1184649cef452f448dc8)
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
Diffstat (limited to 'scripts/lib/kdoc/kdoc_files.py')
0 files changed, 0 insertions, 0 deletions