]> Git Repo - linux.git/commit
drm/xe/queue: move xa_alloc to prevent UAF
authorMatthew Auld <[email protected]>
Wed, 25 Sep 2024 07:14:28 +0000 (08:14 +0100)
committerMatthew Auld <[email protected]>
Fri, 27 Sep 2024 08:28:59 +0000 (09:28 +0100)
commit16536582ddbebdbdf9e1d7af321bbba2bf955a87
treee6084c07c64b4472e1629361fbd183d082a69153
parentdcfd3971327f3ee92765154baebbaece833d3ca9
drm/xe/queue: move xa_alloc to prevent UAF

Evil user can guess the next id of the queue before the ioctl completes
and then call queue destroy ioctl to trigger UAF since create ioctl is
still referencing the same queue. Move the xa_alloc all the way to the end
to prevent this.

v2:
 - Rebase

Fixes: 2149ded63079 ("drm/xe: Fix use after free when client stats are captured")
Signed-off-by: Matthew Auld <[email protected]>
Cc: Matthew Brost <[email protected]>
Reviewed-by: Nirmoy Das <[email protected]>
Reviewed-by: Matthew Brost <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
drivers/gpu/drm/xe/xe_exec_queue.c
This page took 0.052927 seconds and 4 git commands to generate.