diff options
| author | Matthew Auld <matthew.auld@intel.com> | 2024-09-25 10:14:27 +0300 |
|---|---|---|
| committer | Lucas De Marchi <lucas.demarchi@intel.com> | 2024-10-03 09:22:05 +0300 |
| commit | 74231870cf4976f69e83aa24f48edb16619f652f (patch) | |
| tree | ffbaeb8fc1c74f6d368f30b957e54cd694174e6f /tools/perf/scripts/python | |
| parent | 9e3c85ddea7a473ed57b6cdfef2dfd468356fc91 (diff) | |
| download | linux-74231870cf4976f69e83aa24f48edb16619f652f.tar.xz | |
drm/xe/vm: move xa_alloc to prevent UAF
Evil user can guess the next id of the vm before the ioctl completes and
then call vm destroy ioctl to trigger UAF since create ioctl is still
referencing the same vm. Move the xa_alloc all the way to the end to
prevent this.
v2:
- Rebase
Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: <stable@vger.kernel.org> # v6.8+
Reviewed-by: Nirmoy Das <nirmoy.das@intel.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240925071426.144015-3-matthew.auld@intel.com
(cherry picked from commit dcfd3971327f3ee92765154baebbaece833d3ca9)
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions