diff options
| author | Matthew Brost <[email protected]> | 2024-08-20 13:23:09 -0700 |
|---|---|---|
| committer | Matthew Brost <[email protected]> | 2024-08-21 08:38:37 -0700 |
| commit | 32a42c93b74c8ca6d0915ea3eba21bceff53042f (patch) | |
| tree | 2557d044046e633d664f7614b311b262a833c7ad | |
| parent | 60db6f540af9f93144d5039140aa2ed17171d168 (diff) | |
drm/xe: Free job before xe_exec_queue_put
Free job depends on job->vm being valid, the last xe_exec_queue_put can
destroy the VM. Prevent UAF by freeing job before xe_exec_queue_put.
Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Signed-off-by: Matthew Brost <[email protected]>
Reviewed-by: Nirmoy Das <[email protected]>
Reviewed-by: Jagmeet Randhawa <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
| -rw-r--r-- | drivers/gpu/drm/xe/xe_sched_job.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/gpu/drm/xe/xe_sched_job.c b/drivers/gpu/drm/xe/xe_sched_job.c index 44d534e362cd..9628f9deb3c0 100644 --- a/drivers/gpu/drm/xe/xe_sched_job.c +++ b/drivers/gpu/drm/xe/xe_sched_job.c @@ -171,12 +171,13 @@ void xe_sched_job_destroy(struct kref *ref) struct xe_sched_job *job = container_of(ref, struct xe_sched_job, refcount); struct xe_device *xe = job_to_xe(job); + struct xe_exec_queue *q = job->q; xe_sched_job_free_fences(job); - xe_exec_queue_put(job->q); dma_fence_put(job->fence); drm_sched_job_cleanup(&job->drm); job_free(job); + xe_exec_queue_put(q); xe_pm_runtime_put(xe); } |