diff options
| author | Matthew Auld <[email protected]> | 2024-09-25 08:14:28 +0100 |
|---|---|---|
| committer | Lucas De Marchi <[email protected]> | 2024-10-03 01:22:50 -0500 |
| commit | 67801fa67b94ebd0e4da7a77ac2d9f321b75fbe0 (patch) | |
| tree | 615407fffc6f3c45240fb2c0667584803f5ff12e /rust/helpers/build_bug.c | |
| parent | 74231870cf4976f69e83aa24f48edb16619f652f (diff) | |
drm/xe/queue: move xa_alloc to prevent UAF
Evil user can guess the next id of the queue before the ioctl completes
and then call queue destroy ioctl to trigger UAF since create ioctl is
still referencing the same queue. Move the xa_alloc all the way to the end
to prevent this.
v2:
- Rebase
Fixes: 2149ded63079 ("drm/xe: Fix use after free when client stats are captured")
Signed-off-by: Matthew Auld <[email protected]>
Cc: Matthew Brost <[email protected]>
Reviewed-by: Nirmoy Das <[email protected]>
Reviewed-by: Matthew Brost <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
(cherry picked from commit 16536582ddbebdbdf9e1d7af321bbba2bf955a87)
Signed-off-by: Lucas De Marchi <[email protected]>
Diffstat (limited to 'rust/helpers/build_bug.c')
0 files changed, 0 insertions, 0 deletions