linux-kernel - Re: [PATCH] drm/imagination: take paired job reference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <93a5cdb4-ee30-47b7-8be7-cbeb853f94fd@imgtec.com>
Date: Mon, 24 Mar 2025 14:49:11 +0000
From: Matt Coster <Matt.Coster@...tec.com>
To: Brendan King <Brendan.King@...tec.com>
CC: Frank Binns <Frank.Binns@...tec.com>,
        Maarten Lankhorst
	<maarten.lankhorst@...ux.intel.com>,
        Maxime Ripard <mripard@...nel.org>,
        Thomas Zimmermann <tzimmermann@...e.de>,
        David Airlie <airlied@...il.com>, Simona Vetter <simona@...ll.ch>,
        Boris Brezillon
	<boris.brezillon@...labora.com>,
        "dri-devel@...ts.freedesktop.org"
	<dri-devel@...ts.freedesktop.org>,
        "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>,
        "stable@...r.kernel.org"
	<stable@...r.kernel.org>
Subject: Re: [PATCH] drm/imagination: take paired job reference

On 18/03/2025 14:53, Brendan King via B4 Relay wrote:
> From: Brendan King <Brendan.King@...tec.com>
> 
> For paired jobs, have the fragment job take a reference on the
> geometry job, so that the geometry job cannot be freed until
> the fragment job has finished with it.
> 
> The geometry job structure is accessed when the fragment job is being
> prepared by the GPU scheduler. Taking the reference prevents the
> geometry job being freed until the fragment job no longer requires it.
> 
> Fixes a use after free bug detected by KASAN:
> 
> [  124.256386] BUG: KASAN: slab-use-after-free in pvr_queue_prepare_job+0x108/0x868 [powervr]
> [  124.264893] Read of size 1 at addr ffff0000084cb960 by task kworker/u16:4/63
> 
> Cc: stable@...r.kernel.org
> Fixes: eaf01ee5ba28 ("drm/imagination: Implement job submission and scheduling")
> Signed-off-by: Brendan King <brendan.king@...tec.com>

Reviewed-by: Matt Coster <matt.coster@...tec.com>

I'll apply this to drm-misc-fixed tomorrow if there are no objections.

> ---
>  drivers/gpu/drm/imagination/pvr_job.c   | 7 +++++++
>  drivers/gpu/drm/imagination/pvr_queue.c | 4 ++++
>  2 files changed, 11 insertions(+)
> 
> diff --git a/drivers/gpu/drm/imagination/pvr_job.c b/drivers/gpu/drm/imagination/pvr_job.c
> index 1cdb3cfd058d7db573337a2b4f6895ee4922f9a9..59b334d094fa826f26668d98561e956ec9c51428 100644
> --- a/drivers/gpu/drm/imagination/pvr_job.c
> +++ b/drivers/gpu/drm/imagination/pvr_job.c
> @@ -671,6 +671,13 @@ pvr_jobs_link_geom_frag(struct pvr_job_data *job_data, u32 *job_count)
>  		geom_job->paired_job = frag_job;
>  		frag_job->paired_job = geom_job;
>  
> +		/* The geometry job pvr_job structure is used when the fragment
> +		 * job is being prepared by the GPU scheduler. Have the fragment
> +		 * job hold a reference on the geometry job to prevent it being
> +		 * freed until the fragment job has finished with it.
> +		 */
> +		pvr_job_get(geom_job);
> +
>  		/* Skip the fragment job we just paired to the geometry job. */
>  		i++;
>  	}
> diff --git a/drivers/gpu/drm/imagination/pvr_queue.c b/drivers/gpu/drm/imagination/pvr_queue.c
> index 21c185d18bb2e0569bd6e12832a74e38137bd48a..6431f6b654a2e60b86a46bd8571eb9f8133c4b53 100644
> --- a/drivers/gpu/drm/imagination/pvr_queue.c
> +++ b/drivers/gpu/drm/imagination/pvr_queue.c
> @@ -856,6 +856,10 @@ static void pvr_queue_free_job(struct drm_sched_job *sched_job)
>  	struct pvr_job *job = container_of(sched_job, struct pvr_job, base);
>  
>  	drm_sched_job_cleanup(sched_job);
> +
> +	if (job->type == DRM_PVR_JOB_TYPE_FRAGMENT && job->paired_job)
> +		pvr_job_put(job->paired_job);
> +
>  	job->paired_job = NULL;
>  	pvr_job_put(job);
>  }
> 
> ---
> base-commit: 96c85e428ebaeacd2c640eba075479ab92072ccd
> change-id: 20250318-ddkopsrc-1337-use-after-free-in-pvr_queue_prepare_job-16fbc74b0c20
> 
> Best regards,


-- 
Matt Coster
E: matt.coster@...tec.com


Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (237 bytes)