diff options
| author | Thomas Hellström <thomas.hellstrom@linux.intel.com> | 2025-03-26 09:05:48 +0100 |
|---|---|---|
| committer | Lucas De Marchi <lucas.demarchi@intel.com> | 2025-04-07 13:16:06 -0700 |
| commit | 1d8c0557927e6d69cb6341b7792f882412cfccff (patch) | |
| tree | 9d523072c31d465bc4ecdec99db31276fd7b7dec /scripts/generate_rust_analyzer.py | |
| parent | 5529df92b8e8cbb4b14a226665888f74648260ad (diff) | |
drm/xe/svm: Fix a potential bo UAF
If drm_gpusvm_migrate_to_devmem() succeeds, if a cpu access happens to the
range the bo may be freed before xe_bo_unlock(), causing a UAF.
Since the reference is transferred, use xe_svm_devmem_release() to
release the reference on drm_gpusvm_migrate_to_devmem() failure,
and hold a local reference to protect the UAF.
Fixes: 2f118c949160 ("drm/xe: Add SVM VRAM migration")
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://lore.kernel.org/r/20250326080551.40201-3-thomas.hellstrom@linux.intel.com
(cherry picked from commit c9db07cab766b665c8fa1184649cef452f448dc8)
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
Diffstat (limited to 'scripts/generate_rust_analyzer.py')
0 files changed, 0 insertions, 0 deletions