lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 7 Jun 2022 14:36:02 -0400 From: Alex Deucher <alexdeucher@...il.com> To: Xiaohui Zhang <xiaohuizhang@....edu.cn> Cc: Alex Deucher <alexander.deucher@....com>, Christian Koenig <christian.koenig@....com>, xinhui pan <Xinhui.Pan@....com>, David Airlie <airlied@...ux.ie>, Daniel Vetter <daniel@...ll.ch>, amd-gfx list <amd-gfx@...ts.freedesktop.org>, Maling list - DRI developers <dri-devel@...ts.freedesktop.org>, LKML <linux-kernel@...r.kernel.org> Subject: Re: [PATCH 1/1] drm/radeon: Initialize fences array entries in radeon_sa_bo_next_hole Applied. Thanks! Alex On Tue, Jun 7, 2022 at 12:04 PM Xiaohui Zhang <xiaohuizhang@....edu.cn> wrote: > > Similar to the handling of amdgpu_sa_bo_next_hole in commit 6a15f3ff19a8 > ("drm/amdgpu: Initialize fences array entries in amdgpu_sa_bo_next_hole"), > we thought a patch might be needed here as well. > > The entries were only initialized once in radeon_sa_bo_new. If a fence > wasn't signalled yet in the first radeon_sa_bo_next_hole call, but then > got signalled before a later radeon_sa_bo_next_hole call, it could > destroy the fence but leave its pointer in the array, resulting in > use-after-free in radeon_sa_bo_new. > > Signed-off-by: Xiaohui Zhang <xiaohuizhang@....edu.cn> > --- > drivers/gpu/drm/radeon/radeon_sa.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/drivers/gpu/drm/radeon/radeon_sa.c b/drivers/gpu/drm/radeon/radeon_sa.c > index 310c322c7112..0981948bd9ed 100644 > --- a/drivers/gpu/drm/radeon/radeon_sa.c > +++ b/drivers/gpu/drm/radeon/radeon_sa.c > @@ -267,6 +267,8 @@ static bool radeon_sa_bo_next_hole(struct radeon_sa_manager *sa_manager, > for (i = 0; i < RADEON_NUM_RINGS; ++i) { > struct radeon_sa_bo *sa_bo; > > + fences[i] = NULL; > + > if (list_empty(&sa_manager->flist[i])) { > continue; > } > @@ -332,10 +334,8 @@ int radeon_sa_bo_new(struct radeon_device *rdev, > > spin_lock(&sa_manager->wq.lock); > do { > - for (i = 0; i < RADEON_NUM_RINGS; ++i) { > - fences[i] = NULL; > + for (i = 0; i < RADEON_NUM_RINGS; ++i) > tries[i] = 0; > - } > > do { > radeon_sa_bo_try_free(sa_manager); > -- > 2.17.1 >
Powered by blists - more mailing lists