[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <93a5cdb4-ee30-47b7-8be7-cbeb853f94fd@imgtec.com>
Date: Mon, 24 Mar 2025 14:49:11 +0000
From: Matt Coster <Matt.Coster@...tec.com>
To: Brendan King <Brendan.King@...tec.com>
CC: Frank Binns <Frank.Binns@...tec.com>,
Maarten Lankhorst
<maarten.lankhorst@...ux.intel.com>,
Maxime Ripard <mripard@...nel.org>,
Thomas Zimmermann <tzimmermann@...e.de>,
David Airlie <airlied@...il.com>, Simona Vetter <simona@...ll.ch>,
Boris Brezillon
<boris.brezillon@...labora.com>,
"dri-devel@...ts.freedesktop.org"
<dri-devel@...ts.freedesktop.org>,
"linux-kernel@...r.kernel.org"
<linux-kernel@...r.kernel.org>,
"stable@...r.kernel.org"
<stable@...r.kernel.org>
Subject: Re: [PATCH] drm/imagination: take paired job reference
On 18/03/2025 14:53, Brendan King via B4 Relay wrote:
> From: Brendan King <Brendan.King@...tec.com>
>
> For paired jobs, have the fragment job take a reference on the
> geometry job, so that the geometry job cannot be freed until
> the fragment job has finished with it.
>
> The geometry job structure is accessed when the fragment job is being
> prepared by the GPU scheduler. Taking the reference prevents the
> geometry job being freed until the fragment job no longer requires it.
>
> Fixes a use after free bug detected by KASAN:
>
> [ 124.256386] BUG: KASAN: slab-use-after-free in pvr_queue_prepare_job+0x108/0x868 [powervr]
> [ 124.264893] Read of size 1 at addr ffff0000084cb960 by task kworker/u16:4/63
>
> Cc: stable@...r.kernel.org
> Fixes: eaf01ee5ba28 ("drm/imagination: Implement job submission and scheduling")
> Signed-off-by: Brendan King <brendan.king@...tec.com>
Reviewed-by: Matt Coster <matt.coster@...tec.com>
I'll apply this to drm-misc-fixed tomorrow if there are no objections.
> ---
> drivers/gpu/drm/imagination/pvr_job.c | 7 +++++++
> drivers/gpu/drm/imagination/pvr_queue.c | 4 ++++
> 2 files changed, 11 insertions(+)
>
> diff --git a/drivers/gpu/drm/imagination/pvr_job.c b/drivers/gpu/drm/imagination/pvr_job.c
> index 1cdb3cfd058d7db573337a2b4f6895ee4922f9a9..59b334d094fa826f26668d98561e956ec9c51428 100644
> --- a/drivers/gpu/drm/imagination/pvr_job.c
> +++ b/drivers/gpu/drm/imagination/pvr_job.c
> @@ -671,6 +671,13 @@ pvr_jobs_link_geom_frag(struct pvr_job_data *job_data, u32 *job_count)
> geom_job->paired_job = frag_job;
> frag_job->paired_job = geom_job;
>
> + /* The geometry job pvr_job structure is used when the fragment
> + * job is being prepared by the GPU scheduler. Have the fragment
> + * job hold a reference on the geometry job to prevent it being
> + * freed until the fragment job has finished with it.
> + */
> + pvr_job_get(geom_job);
> +
> /* Skip the fragment job we just paired to the geometry job. */
> i++;
> }
> diff --git a/drivers/gpu/drm/imagination/pvr_queue.c b/drivers/gpu/drm/imagination/pvr_queue.c
> index 21c185d18bb2e0569bd6e12832a74e38137bd48a..6431f6b654a2e60b86a46bd8571eb9f8133c4b53 100644
> --- a/drivers/gpu/drm/imagination/pvr_queue.c
> +++ b/drivers/gpu/drm/imagination/pvr_queue.c
> @@ -856,6 +856,10 @@ static void pvr_queue_free_job(struct drm_sched_job *sched_job)
> struct pvr_job *job = container_of(sched_job, struct pvr_job, base);
>
> drm_sched_job_cleanup(sched_job);
> +
> + if (job->type == DRM_PVR_JOB_TYPE_FRAGMENT && job->paired_job)
> + pvr_job_put(job->paired_job);
> +
> job->paired_job = NULL;
> pvr_job_put(job);
> }
>
> ---
> base-commit: 96c85e428ebaeacd2c640eba075479ab92072ccd
> change-id: 20250318-ddkopsrc-1337-use-after-free-in-pvr_queue_prepare_job-16fbc74b0c20
>
> Best regards,
--
Matt Coster
E: matt.coster@...tec.com
Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (237 bytes)
Powered by blists - more mailing lists