diff options
| author | Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com> | 2023-04-07 23:55:22 +0300 |
|---|---|---|
| committer | Rodrigo Vivi <rodrigo.vivi@intel.com> | 2023-12-20 02:31:40 +0300 |
| commit | 2988cf02ee303a96052a6c486b9bbb6e4fd5c030 (patch) | |
| tree | 57c6f79a436a60924ce597cabbef3f2e6eca7a45 /drivers/gpu/drm/xe/xe_guc_ct_types.h | |
| parent | 36919ebeaacab3409c8266248221f392ee7ea9d8 (diff) | |
| download | linux-2988cf02ee303a96052a6c486b9bbb6e4fd5c030.tar.xz | |
drm/xe: Fix memory use after free
The wait_event_timeout() on g2h_fence.wq which is declared on
stack can return before the wake_up() gets called, resulting in a
stack out of bound access when wake_up() accesses the g2h_fene.wq.
Do not declare g2h_fence related wait_queue_head_t on stack.
Fixes the below KASAN BUG and associated kernel crashes.
BUG: KASAN: stack-out-of-bounds in do_raw_spin_lock+0x6f/0x1e0
Read of size 4 at addr ffff88826252f4ac by task kworker/u128:5/467
CPU: 25 PID: 467 Comm: kworker/u128:5 Tainted: G U 6.3.0-rc4-xe #1
Workqueue: events_unbound g2h_worker_func [xe]
Call Trace:
<TASK>
dump_stack_lvl+0x64/0xb0
print_report+0xc2/0x600
kasan_report+0x96/0xc0
do_raw_spin_lock+0x6f/0x1e0
_raw_spin_lock_irqsave+0x47/0x60
__wake_up_common_lock+0xc0/0x150
dequeue_one_g2h+0x20f/0x6a0 [xe]
g2h_worker_func+0xa9/0x180 [xe]
process_one_work+0x527/0x990
worker_thread+0x2d1/0x640
kthread+0x174/0x1b0
ret_from_fork+0x29/0x50
</TASK>
Tested-by: Matt Roper <matthew.d.roper@intel.com>
Reviewed-by: Bruce Chang <yu.bruce.chang@intel.com>
Signed-off-by: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com>
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Diffstat (limited to 'drivers/gpu/drm/xe/xe_guc_ct_types.h')
| -rw-r--r-- | drivers/gpu/drm/xe/xe_guc_ct_types.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/gpu/drm/xe/xe_guc_ct_types.h b/drivers/gpu/drm/xe/xe_guc_ct_types.h index e0f9063e9b65..fd27dacf00c5 100644 --- a/drivers/gpu/drm/xe/xe_guc_ct_types.h +++ b/drivers/gpu/drm/xe/xe_guc_ct_types.h @@ -74,6 +74,8 @@ struct xe_guc_ct { struct xarray fence_lookup; /** @wq: wait queue used for reliable CT sends and freeing G2H credits */ wait_queue_head_t wq; + /** @g2h_fence_wq: wait queue used for G2H fencing */ + wait_queue_head_t g2h_fence_wq; #ifdef XE_GUC_CT_SELFTEST /** @suppress_irq_handler: force flow control to sender */ bool suppress_irq_handler; |