Re: [PATCH 1/2] drm/i915: Fix a potential UAF at device unload

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




On 9/9/2022 10:55 AM, Tvrtko Ursulin wrote:

On 08/09/2022 21:07, Nirmoy Das wrote:
i915_gem_drain_freed_objects() might not be enough to
free all the objects and RCU delayed work might get
scheduled after the i915 device struct gets freed.

Call i915_gem_drain_workqueue() to catch all RCU delayed work.

Suggested-by: Chris Wilson <chris.p.wilson@xxxxxxxxx>
Signed-off-by: Nirmoy Das <nirmoy.das@xxxxxxxxx>
---
  drivers/gpu/drm/i915/i915_gem.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 0f49ec9d494a..e8a053eaaa89 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1254,7 +1254,7 @@ void i915_gem_init_early(struct drm_i915_private *dev_priv)
    void i915_gem_cleanup_early(struct drm_i915_private *dev_priv)
  {
-    i915_gem_drain_freed_objects(dev_priv);
+    i915_gem_drain_workqueue(dev_priv);
      GEM_BUG_ON(!llist_empty(&dev_priv->mm.free_list));
      GEM_BUG_ON(atomic_read(&dev_priv->mm.free_count));
      drm_WARN_ON(&dev_priv->drm, dev_priv->mm.shrink_count);


Help me spot the place where RCU free worker schedules itself back to free more objects - if I got the rationale here right?
(Sorry for late reply, was on leave last week.)

I had to clarify this with Chris. So when driver frees a obj, it does dma_resv_fini() which will drop reference

for all the fences in it and a fence might  reference to an object and upon release of that fence can trigger a  release reference to an object.

Regards,

Nirmoy




Regards,

Tvrtko



[Index of Archives]     [AMD Graphics]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux