Re: [Intel-gfx] [PATCH] drm/i915: Prevent potential UAF in engine_init_common

[Nirmoy Das]

On 10/11/2023 2:20 PM, Jani Nikula wrote:

On Wed, 11 Oct 2023, Nirmoy Das <nirmoy....@intel.com> wrote:

If measure_breadcrumb_dw() returns an error and bce isn't created,
this commit ensures that intel_engine_destroy_pinned_context()
is not called with a NULL bce.

So it's a potential NULL pointer dereference, not use after free like
the subject says. Please fix the subject.

ah right. I will resend.


Thanks,

Nirmoy

BR,
Jani.

Fixes: b35274993680 ("drm/i915: Create a kernel context for GGTT updates")
Cc: Oak Zeng <oak.z...@intel.com>
Cc: Andi Shyti <andi.sh...@linux.intel.com>
Signed-off-by: Nirmoy Das <nirmoy....@intel.com>
---
  drivers/gpu/drm/i915/gt/intel_engine_cs.c | 3 ++-
  1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c 
b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
index 179d9546865b..4a11219e560e 100644
--- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c
+++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
@@ -1491,7 +1491,8 @@ static int engine_init_common(struct intel_engine_cs 
*engine)
        return 0;

err_bce_context:

-       intel_engine_destroy_pinned_context(bce);
+       if (bce)
+               intel_engine_destroy_pinned_context(bce);
  err_ce_context:
        intel_engine_destroy_pinned_context(ce);
        return ret;