Re: [Intel-gfx] [PATCH] drm/i915: Fix vm use-after-free in vma destruction

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi, Andi

On 5/19/22 23:46, Andi Shyti wrote:
Hi Thomas,

On Thu, May 12, 2022 at 11:40:45AM +0200, Thomas Hellström wrote:
In vma destruction, the following race may occur:

Thread 1:	    		  Thread 2:
i915_vma_destroy();

   ...
   list_del_init(vma->vm_link);
   ...
   mutex_unlock(vma->vm->mutex);
				  __i915_vm_release();
release_references();

And in release_reference() we dereference vma->vm to get to the
vm gt pointer, leadin go a use-after free.
leading to
Thanks, will fix.

[...]

-static void release_references(struct i915_vma *vma, bool vm_ddestroy)
+static void release_references(struct i915_vma *vma, struct intel_gt *gt,
+			       bool vm_ddestroy)
  {
  	struct drm_i915_gem_object *obj = vma->obj;
-	struct intel_gt *gt = vma->vm->gt;
GEM_BUG_ON(i915_vma_is_active(vma));
but then we have

	if (vm_ddestroy)
		i915_vm_resv_put(vma->vm);

were we reference to a freed vm, right? Do we need to check it
here, as well?

No, it's not needed, since if vm_ddestroy is true, we keep the vm alive using the vm resv_ref until i915_vm_resv_put(). This is for the rare occasions where, during vm destruction, we fail to grab an object reference and therefore vma destruction is left for the object destructor. In those cases the vma needs to keep the vm in memory for it to be able to grab the vm mutex.

/Thomas





Andi



[Index of Archives]     [Linux DRI Users]     [Linux Intel Graphics]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [XFree86]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [XFree86]
  Powered by Linux