| Message ID | 20231011115451.12521-1-nirmoy.das@intel.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | drm/i915: Prevent potential UAF in engine_init_common | expand |
On Wed, 11 Oct 2023, Nirmoy Das <nirmoy.das@intel.com> wrote: > If measure_breadcrumb_dw() returns an error and bce isn't created, > this commit ensures that intel_engine_destroy_pinned_context() > is not called with a NULL bce. So it's a potential NULL pointer dereference, not use after free like the subject says. Please fix the subject. BR, Jani. > > Fixes: b35274993680 ("drm/i915: Create a kernel context for GGTT updates") > Cc: Oak Zeng <oak.zeng@intel.com> > Cc: Andi Shyti <andi.shyti@linux.intel.com> > Signed-off-by: Nirmoy Das <nirmoy.das@intel.com> > --- > drivers/gpu/drm/i915/gt/intel_engine_cs.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c > index 179d9546865b..4a11219e560e 100644 > --- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c > +++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c > @@ -1491,7 +1491,8 @@ static int engine_init_common(struct intel_engine_cs *engine) > return 0; > > err_bce_context: > - intel_engine_destroy_pinned_context(bce); > + if (bce) > + intel_engine_destroy_pinned_context(bce); > err_ce_context: > intel_engine_destroy_pinned_context(ce); > return ret;
On 10/11/2023 2:20 PM, Jani Nikula wrote: > On Wed, 11 Oct 2023, Nirmoy Das <nirmoy.das@intel.com> wrote: >> If measure_breadcrumb_dw() returns an error and bce isn't created, >> this commit ensures that intel_engine_destroy_pinned_context() >> is not called with a NULL bce. > So it's a potential NULL pointer dereference, not use after free like > the subject says. Please fix the subject. ah right. I will resend. Thanks, Nirmoy > > BR, > Jani. > > >> Fixes: b35274993680 ("drm/i915: Create a kernel context for GGTT updates") >> Cc: Oak Zeng <oak.zeng@intel.com> >> Cc: Andi Shyti <andi.shyti@linux.intel.com> >> Signed-off-by: Nirmoy Das <nirmoy.das@intel.com> >> --- >> drivers/gpu/drm/i915/gt/intel_engine_cs.c | 3 ++- >> 1 file changed, 2 insertions(+), 1 deletion(-) >> >> diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c >> index 179d9546865b..4a11219e560e 100644 >> --- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c >> +++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c >> @@ -1491,7 +1491,8 @@ static int engine_init_common(struct intel_engine_cs *engine) >> return 0; >> >> err_bce_context: >> - intel_engine_destroy_pinned_context(bce); >> + if (bce) >> + intel_engine_destroy_pinned_context(bce); >> err_ce_context: >> intel_engine_destroy_pinned_context(ce); >> return ret;
Hi Nirmoy, On Wed, Oct 11, 2023 at 01:54:51PM +0200, Nirmoy Das wrote: > If measure_breadcrumb_dw() returns an error and bce isn't created, > this commit ensures that intel_engine_destroy_pinned_context() > is not called with a NULL bce. > > Fixes: b35274993680 ("drm/i915: Create a kernel context for GGTT updates") > Cc: Oak Zeng <oak.zeng@intel.com> > Cc: Andi Shyti <andi.shyti@linux.intel.com> > Signed-off-by: Nirmoy Das <nirmoy.das@intel.com> Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com> Andi
Hi Andi, On 10/11/2023 2:22 PM, Andi Shyti wrote: > Hi Nirmoy, > > On Wed, Oct 11, 2023 at 01:54:51PM +0200, Nirmoy Das wrote: >> If measure_breadcrumb_dw() returns an error and bce isn't created, >> this commit ensures that intel_engine_destroy_pinned_context() >> is not called with a NULL bce. >> >> Fixes: b35274993680 ("drm/i915: Create a kernel context for GGTT updates") >> Cc: Oak Zeng <oak.zeng@intel.com> >> Cc: Andi Shyti <andi.shyti@linux.intel.com> >> Signed-off-by: Nirmoy Das <nirmoy.das@intel.com> > Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com> Resent with a fixed subject. Please check again. Thanks, Nirmoy > > Andi
diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c index 179d9546865b..4a11219e560e 100644 --- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c +++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c @@ -1491,7 +1491,8 @@ static int engine_init_common(struct intel_engine_cs *engine) return 0; err_bce_context: - intel_engine_destroy_pinned_context(bce); + if (bce) + intel_engine_destroy_pinned_context(bce); err_ce_context: intel_engine_destroy_pinned_context(ce); return ret;
If measure_breadcrumb_dw() returns an error and bce isn't created, this commit ensures that intel_engine_destroy_pinned_context() is not called with a NULL bce. Fixes: b35274993680 ("drm/i915: Create a kernel context for GGTT updates") Cc: Oak Zeng <oak.zeng@intel.com> Cc: Andi Shyti <andi.shyti@linux.intel.com> Signed-off-by: Nirmoy Das <nirmoy.das@intel.com> --- drivers/gpu/drm/i915/gt/intel_engine_cs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)