Commit 99343c46 authored by Rob Clark's avatar Rob Clark Committed by Tvrtko Ursulin
Browse files

drm/i915: Avoid potential vm use-after-free 



Adding the vm to the vm_xa table makes it visible to userspace, which
could try to race with us to close the vm.  So we need to take our extra
reference before putting it in the table.

Signed-off-by: default avatarRob Clark <robdclark@chromium.org>
Reviewed-by: default avatarMatthew Auld <matthew.auld@intel.com>
Fixes: 9ec8795e ("drm/i915: Drop __rcu from gem_context->vm")
Cc: <stable@vger.kernel.org> # v5.16+
Signed-off-by: default avatarTvrtko Ursulin <tvrtko.ursulin@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230119173321.2825472-1-robdclark@gmail.com
parent 7649a5d1

drivers/gpu/drm/i915/gem/i915_gem_context.c

+11 −3
Original line number Diff line number Diff line
@@ -1860,11 +1860,19 @@ static int get_ppgtt(struct drm_i915_file_private *file_priv, 
	vm = ctx->vm;

	GEM_BUG_ON(!vm);



	/*

	 * Get a reference for the allocated handle.  Once the handle is

	 * visible in the vm_xa table, userspace could try to close it

	 * from under our feet, so we need to hold the extra reference

	 * first.

	 */

	i915_vm_get(vm);



	err = xa_alloc(&file_priv->vm_xa, &id, vm, xa_limit_32b, GFP_KERNEL);

	if (err)

	if (err) {

		i915_vm_put(vm);

		return err;



	i915_vm_get(vm);

	}



	GEM_BUG_ON(id == 0); /* reserved for invalid/unassigned ppgtt */

	args->value = id;