From nobody Sun Apr 12 13:35:52 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5B150C54EBC for ; Tue, 3 Jan 2023 23:50:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237846AbjACXuM (ORCPT ); Tue, 3 Jan 2023 18:50:12 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56074 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234287AbjACXuJ (ORCPT ); Tue, 3 Jan 2023 18:50:09 -0500 Received: from mail-pl1-x629.google.com (mail-pl1-x629.google.com [IPv6:2607:f8b0:4864:20::629]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2A6B71004E for ; Tue, 3 Jan 2023 15:50:07 -0800 (PST) Received: by mail-pl1-x629.google.com with SMTP id c6so1083396pls.4 for ; Tue, 03 Jan 2023 15:50:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=zQnU0ECVT+dQJ7sR8SG4+GexJhlU25T9FqYe8rjLTKY=; b=e73Thfnoz4SFEpjmH9KHhQUwNlNGkZNP9KeQqQk9FqpYgcFXDcpgCTa/VjhO9lcDys UW7szsViVc5SLrUAMqx7eDU0kyRcaq8LcQfcc5ikJOhBkfyla1zipbs29GDyAnIvSBBS KP+fnov4T1MNTpUkSsQoH6MwJ2zb8f2WdtTK7RnjEk6De0ODYH6/SxUz9NYsiNyUDNtY N1JCne/SWolLkyRYckgFOHfEBVENlDdmuahFAxnE0LT3LapU4bBxtfOYiOYHJ8SQzDWy sffcALiAJyNFdxkGAT6gCNLsXb968lzVQ9UqosNCO9QkpzdFiGx9zqCRkdyrvsVTy2Qu dEAw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=zQnU0ECVT+dQJ7sR8SG4+GexJhlU25T9FqYe8rjLTKY=; b=x5ELQWGXWtxKZWkwQpWp2/6Wkus3RlH/eUIZR5IZfeFhxhmadUwwmpu/wxTYB/L2fe k8OxJKpJY1mNFL0yJxgBrqjFVSreBLuyOH/wpZjWRjqIB7A35SZzVJhh7Y17tPx/+La8 KMfqbpAIhWS6bPfX7Kt3L39r0Wt85lm+3bJDYo2RSG96tM5L7iAak5wioM6Be/02bSrK xfSHKc0K6j7myCIhQ4PGaOx7Q9rDj+zhdcvlJqFcoN5GBpVYDxiBjceX9kfBARz7Y56z aBfnCHP7fzc88ZXnZrhURiQqqjcJk4JljwbXis7b9x39bfpyhLSR7N98kbl4zq05tHCB O3Ug== X-Gm-Message-State: AFqh2kq+GrppKUq8s9oIkBuiWXdWOPuLurKxe9S/kiiooq7DPzaMyqQz VsIzTIW3LcLnmnykdWuATR4= X-Google-Smtp-Source: AMrXdXsy6k/E7f9XcAebsHie9PSjmY4Ie44xw2EYsZyt5n0Sr2WEKBmcHkFM+UeNsmFffIA/SalRgQ== X-Received: by 2002:a17:903:186:b0:188:d2b3:26c1 with SMTP id z6-20020a170903018600b00188d2b326c1mr63172199plg.10.1672789806528; Tue, 03 Jan 2023 15:50:06 -0800 (PST) Received: from localhost ([2a00:79e1:abd:4a00:2703:3c72:eb1a:cffd]) by smtp.gmail.com with ESMTPSA id u12-20020a170902e80c00b0018968d1c6f3sm22889770plg.59.2023.01.03.15.50.05 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 03 Jan 2023 15:50:06 -0800 (PST) From: Rob Clark To: dri-devel@lists.freedesktop.org Cc: Rob Clark , Jani Nikula , Joonas Lahtinen , Rodrigo Vivi , Tvrtko Ursulin , David Airlie , Daniel Vetter , Chris Wilson , Andi Shyti , John Harrison , Matthew Brost , katrinzhou , =?UTF-8?q?Thomas=20Hellstr=C3=B6m?= , intel-gfx@lists.freedesktop.org (open list:INTEL DRM DRIVERS), linux-kernel@vger.kernel.org (open list) Subject: [PATCH] drm/i915: Fix potential context UAFs Date: Tue, 3 Jan 2023 15:49:46 -0800 Message-Id: <20230103234948.1218393-1-robdclark@gmail.com> X-Mailer: git-send-email 2.38.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Rob Clark gem_context_register() makes the context visible to userspace, and which point a separate thread can trigger the I915_GEM_CONTEXT_DESTROY ioctl. So we need to ensure that nothing uses the ctx ptr after this. And we need to ensure that adding the ctx to the xarray is the *last* thing that gem_context_register() does with the ctx pointer. Signed-off-by: Rob Clark Reviewed-by: Andi Shyti Reviewed-by: Tvrtko Ursulin --- drivers/gpu/drm/i915/gem/i915_gem_context.c | 24 +++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/i915/gem/i915_gem_context.c b/drivers/gpu/drm/= i915/gem/i915_gem_context.c index 7f2831efc798..6250de9b9196 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_context.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c @@ -1688,6 +1688,10 @@ void i915_gem_init__contexts(struct drm_i915_private= *i915) init_contexts(&i915->gem.contexts); } =20 +/* + * Note that this implicitly consumes the ctx reference, by placing + * the ctx in the context_xa. + */ static void gem_context_register(struct i915_gem_context *ctx, struct drm_i915_file_private *fpriv, u32 id) @@ -1703,10 +1707,6 @@ static void gem_context_register(struct i915_gem_con= text *ctx, snprintf(ctx->name, sizeof(ctx->name), "%s[%d]", current->comm, pid_nr(ctx->pid)); =20 - /* And finally expose ourselves to userspace via the idr */ - old =3D xa_store(&fpriv->context_xa, id, ctx, GFP_KERNEL); - WARN_ON(old); - spin_lock(&ctx->client->ctx_lock); list_add_tail_rcu(&ctx->client_link, &ctx->client->ctx_list); spin_unlock(&ctx->client->ctx_lock); @@ -1714,6 +1714,10 @@ static void gem_context_register(struct i915_gem_con= text *ctx, spin_lock(&i915->gem.contexts.lock); list_add_tail(&ctx->link, &i915->gem.contexts.list); spin_unlock(&i915->gem.contexts.lock); + + /* And finally expose ourselves to userspace via the idr */ + old =3D xa_store(&fpriv->context_xa, id, ctx, GFP_KERNEL); + WARN_ON(old); } =20 int i915_gem_context_open(struct drm_i915_private *i915, @@ -2199,14 +2203,22 @@ finalize_create_context_locked(struct drm_i915_file= _private *file_priv, if (IS_ERR(ctx)) return ctx; =20 + /* + * One for the xarray and one for the caller. We need to grab + * the reference *prior* to making the ctx visble to userspace + * in gem_context_register(), as at any point after that + * userspace can try to race us with another thread destroying + * the context under our feet. + */ + i915_gem_context_get(ctx); + gem_context_register(ctx, file_priv, id); =20 old =3D xa_erase(&file_priv->proto_context_xa, id); GEM_BUG_ON(old !=3D pc); proto_context_close(file_priv->dev_priv, pc); =20 - /* One for the xarray and one for the caller */ - return i915_gem_context_get(ctx); + return ctx; } =20 struct i915_gem_context * --=20 2.38.1