Skip to content

Commit 4ba2abe

Browse files
brendan-kingMTCoster
authored andcommitted
drm/imagination: take paired job reference
For paired jobs, have the fragment job take a reference on the geometry job, so that the geometry job cannot be freed until the fragment job has finished with it. The geometry job structure is accessed when the fragment job is being prepared by the GPU scheduler. Taking the reference prevents the geometry job being freed until the fragment job no longer requires it. Fixes a use after free bug detected by KASAN: [ 124.256386] BUG: KASAN: slab-use-after-free in pvr_queue_prepare_job+0x108/0x868 [powervr] [ 124.264893] Read of size 1 at addr ffff0000084cb960 by task kworker/u16:4/63 Cc: [email protected] Fixes: eaf01ee ("drm/imagination: Implement job submission and scheduling") Signed-off-by: Brendan King <[email protected]> Reviewed-by: Matt Coster <[email protected]> Link: https://lore.kernel.org/r/20250318-ddkopsrc-1337-use-after-free-in-pvr_queue_prepare_job-v1-1-80fb30d044a6@imgtec.com Signed-off-by: Matt Coster <[email protected]>
1 parent 021ba7f commit 4ba2abe

File tree

2 files changed

+11
-0
lines changed

2 files changed

+11
-0
lines changed

drivers/gpu/drm/imagination/pvr_job.c

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -677,6 +677,13 @@ pvr_jobs_link_geom_frag(struct pvr_job_data *job_data, u32 *job_count)
677677
geom_job->paired_job = frag_job;
678678
frag_job->paired_job = geom_job;
679679

680+
/* The geometry job pvr_job structure is used when the fragment
681+
* job is being prepared by the GPU scheduler. Have the fragment
682+
* job hold a reference on the geometry job to prevent it being
683+
* freed until the fragment job has finished with it.
684+
*/
685+
pvr_job_get(geom_job);
686+
680687
/* Skip the fragment job we just paired to the geometry job. */
681688
i++;
682689
}

drivers/gpu/drm/imagination/pvr_queue.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -866,6 +866,10 @@ static void pvr_queue_free_job(struct drm_sched_job *sched_job)
866866
struct pvr_job *job = container_of(sched_job, struct pvr_job, base);
867867

868868
drm_sched_job_cleanup(sched_job);
869+
870+
if (job->type == DRM_PVR_JOB_TYPE_FRAGMENT && job->paired_job)
871+
pvr_job_put(job->paired_job);
872+
869873
job->paired_job = NULL;
870874
pvr_job_put(job);
871875
}

0 commit comments

Comments
 (0)