]> Git Repo - linux.git/commit
drm/xe/queue: move xa_alloc to prevent UAF
authorMatthew Auld <[email protected]>
Wed, 25 Sep 2024 07:14:28 +0000 (08:14 +0100)
committerLucas De Marchi <[email protected]>
Thu, 3 Oct 2024 06:22:50 +0000 (01:22 -0500)
commit67801fa67b94ebd0e4da7a77ac2d9f321b75fbe0
tree615407fffc6f3c45240fb2c0667584803f5ff12e
parent74231870cf4976f69e83aa24f48edb16619f652f
drm/xe/queue: move xa_alloc to prevent UAF

Evil user can guess the next id of the queue before the ioctl completes
and then call queue destroy ioctl to trigger UAF since create ioctl is
still referencing the same queue. Move the xa_alloc all the way to the end
to prevent this.

v2:
 - Rebase

Fixes: 2149ded63079 ("drm/xe: Fix use after free when client stats are captured")
Signed-off-by: Matthew Auld <[email protected]>
Cc: Matthew Brost <[email protected]>
Reviewed-by: Nirmoy Das <[email protected]>
Reviewed-by: Matthew Brost <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
(cherry picked from commit 16536582ddbebdbdf9e1d7af321bbba2bf955a87)
Signed-off-by: Lucas De Marchi <[email protected]>
drivers/gpu/drm/xe/xe_exec_queue.c
This page took 0.053193 seconds and 4 git commands to generate.