Patch "drm/xe/vm: move xa_alloc to prevent UAF" has been added to the 6.11-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    drm/xe/vm: move xa_alloc to prevent UAF

to the 6.11-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     drm-xe-vm-move-xa_alloc-to-prevent-uaf.patch
and it can be found in the queue-6.11 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit be973ca7b78419c56e2dc42fecd0d1f432c8527e
Author: Matthew Auld <matthew.auld@xxxxxxxxx>
Date:   Wed Sep 25 08:14:27 2024 +0100

    drm/xe/vm: move xa_alloc to prevent UAF
    
    [ Upstream commit 74231870cf4976f69e83aa24f48edb16619f652f ]
    
    Evil user can guess the next id of the vm before the ioctl completes and
    then call vm destroy ioctl to trigger UAF since create ioctl is still
    referencing the same vm. Move the xa_alloc all the way to the end to
    prevent this.
    
    v2:
     - Rebase
    
    Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
    Signed-off-by: Matthew Auld <matthew.auld@xxxxxxxxx>
    Cc: Matthew Brost <matthew.brost@xxxxxxxxx>
    Cc: <stable@xxxxxxxxxxxxxxx> # v6.8+
    Reviewed-by: Nirmoy Das <nirmoy.das@xxxxxxxxx>
    Reviewed-by: Matthew Brost <matthew.brost@xxxxxxxxx>
    Link: https://patchwork.freedesktop.org/patch/msgid/20240925071426.144015-3-matthew.auld@xxxxxxxxx
    (cherry picked from commit dcfd3971327f3ee92765154baebbaece833d3ca9)
    Signed-off-by: Lucas De Marchi <lucas.demarchi@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c
index 8fb425ad9e4a4..49ba9a1e375f4 100644
--- a/drivers/gpu/drm/xe/xe_vm.c
+++ b/drivers/gpu/drm/xe/xe_vm.c
@@ -1905,10 +1905,6 @@ int xe_vm_create_ioctl(struct drm_device *dev, void *data,
 	if (IS_ERR(vm))
 		return PTR_ERR(vm);
 
-	err = xa_alloc(&xef->vm.xa, &id, vm, xa_limit_32b, GFP_KERNEL);
-	if (err)
-		goto err_close_and_put;
-
 	if (xe->info.has_asid) {
 		mutex_lock(&xe->usm.lock);
 		err = xa_alloc_cyclic(&xe->usm.asid_to_vm, &asid, vm,
@@ -1916,12 +1912,11 @@ int xe_vm_create_ioctl(struct drm_device *dev, void *data,
 				      &xe->usm.next_asid, GFP_KERNEL);
 		mutex_unlock(&xe->usm.lock);
 		if (err < 0)
-			goto err_free_id;
+			goto err_close_and_put;
 
 		vm->usm.asid = asid;
 	}
 
-	args->vm_id = id;
 	vm->xef = xe_file_get(xef);
 
 	/* Record BO memory for VM pagetable created against client */
@@ -1934,10 +1929,15 @@ int xe_vm_create_ioctl(struct drm_device *dev, void *data,
 	args->reserved[0] = xe_bo_main_addr(vm->pt_root[0]->bo, XE_PAGE_SIZE);
 #endif
 
+	/* user id alloc must always be last in ioctl to prevent UAF */
+	err = xa_alloc(&xef->vm.xa, &id, vm, xa_limit_32b, GFP_KERNEL);
+	if (err)
+		goto err_close_and_put;
+
+	args->vm_id = id;
+
 	return 0;
 
-err_free_id:
-	xa_erase(&xef->vm.xa, id);
 err_close_and_put:
 	xe_vm_close_and_put(vm);