On 18/03/2025 14:53, Brendan King via B4 Relay wrote:
> From: Brendan King <brendan.k...@imgtec.com>
>
> For paired jobs, have the fragment job take a reference on the
> geometry job, so that the geometry job cannot be freed until
> the fragment job has finished with it.
>
> The geometry job structure is accessed when the fragment job is being
> prepared by the GPU scheduler. Taking the reference prevents the
> geometry job being freed until the fragment job no longer requires it.
>
> Fixes a use after free bug detected by KASAN:
>
> [ 124.256386] BUG: KASAN: slab-use-after-free in
> pvr_queue_prepare_job+0x108/0x868 [powervr]
> [ 124.264893] Read of size 1 at addr ffff0000084cb960 by task
> kworker/u16:4/63
>
> Cc: sta...@vger.kernel.org
> Fixes: eaf01ee5ba28 ("drm/imagination: Implement job submission and
> scheduling")
> Signed-off-by: Brendan King <brendan.k...@imgtec.com>Reviewed-by: Matt Coster <matt.cos...@imgtec.com> I'll apply this to drm-misc-fixed tomorrow if there are no objections. > --- > drivers/gpu/drm/imagination/pvr_job.c | 7 +++++++ > drivers/gpu/drm/imagination/pvr_queue.c | 4 ++++ > 2 files changed, 11 insertions(+) > > diff --git a/drivers/gpu/drm/imagination/pvr_job.c > b/drivers/gpu/drm/imagination/pvr_job.c > index > 1cdb3cfd058d7db573337a2b4f6895ee4922f9a9..59b334d094fa826f26668d98561e956ec9c51428 > 100644 > --- a/drivers/gpu/drm/imagination/pvr_job.c > +++ b/drivers/gpu/drm/imagination/pvr_job.c > @@ -671,6 +671,13 @@ pvr_jobs_link_geom_frag(struct pvr_job_data *job_data, > u32 *job_count) > geom_job->paired_job = frag_job; > frag_job->paired_job = geom_job; > > + /* The geometry job pvr_job structure is used when the fragment > + * job is being prepared by the GPU scheduler. Have the fragment > + * job hold a reference on the geometry job to prevent it being > + * freed until the fragment job has finished with it. > + */ > + pvr_job_get(geom_job); > + > /* Skip the fragment job we just paired to the geometry job. */ > i++; > } > diff --git a/drivers/gpu/drm/imagination/pvr_queue.c > b/drivers/gpu/drm/imagination/pvr_queue.c > index > 21c185d18bb2e0569bd6e12832a74e38137bd48a..6431f6b654a2e60b86a46bd8571eb9f8133c4b53 > 100644 > --- a/drivers/gpu/drm/imagination/pvr_queue.c > +++ b/drivers/gpu/drm/imagination/pvr_queue.c > @@ -856,6 +856,10 @@ static void pvr_queue_free_job(struct drm_sched_job > *sched_job) > struct pvr_job *job = container_of(sched_job, struct pvr_job, base); > > drm_sched_job_cleanup(sched_job); > + > + if (job->type == DRM_PVR_JOB_TYPE_FRAGMENT && job->paired_job) > + pvr_job_put(job->paired_job); > + > job->paired_job = NULL; > pvr_job_put(job); > } > > --- > base-commit: 96c85e428ebaeacd2c640eba075479ab92072ccd > change-id: > 20250318-ddkopsrc-1337-use-after-free-in-pvr_queue_prepare_job-16fbc74b0c20 > > Best regards, -- Matt Coster E: matt.cos...@imgtec.com
OpenPGP_signature.asc
Description: OpenPGP digital signature
