diff options
| author | Rob Clark <robdclark@chromium.org> | 2023-01-03 15:49:46 -0800 |
|---|---|---|
| committer | Rodrigo Vivi <rodrigo.vivi@intel.com> | 2023-01-09 10:36:38 -0500 |
| commit | afce71ff6daa9c0f852df0727fe32c6fb107f0fa (patch) | |
| tree | b5b98ce147cba9e21c4a3e2cafda0f4c867f8485 /drivers/gpu/drm/i915/intel_region_ttm.h | |
| parent | 476fdcdaaae7b06c780cdfc234c704107f16c529 (diff) | |
drm/i915: Fix potential context UAFs
gem_context_register() makes the context visible to userspace, and which
point a separate thread can trigger the I915_GEM_CONTEXT_DESTROY ioctl.
So we need to ensure that nothing uses the ctx ptr after this. And we
need to ensure that adding the ctx to the xarray is the *last* thing
that gem_context_register() does with the ctx pointer.
Signed-off-by: Rob Clark <robdclark@chromium.org>
Fixes: eb4dedae920a ("drm/i915/gem: Delay tracking the GEM context until it is registered")
Fixes: a4c1cdd34e2c ("drm/i915/gem: Delay context creation (v3)")
Fixes: 49bd54b390c2 ("drm/i915: Track all user contexts per client")
Cc: <stable@vger.kernel.org> # v5.10+
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
[tursulin: Stable and fixes tags add/tidy.]
Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230103234948.1218393-1-robdclark@gmail.com
(cherry picked from commit bed4b455cf5374e68879be56971c1da563bcd90c)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Diffstat (limited to 'drivers/gpu/drm/i915/intel_region_ttm.h')
0 files changed, 0 insertions, 0 deletions