Re: [Intel-gfx] [PATCH] drm/i915: Prevent potential UAF in engine_init_common

2023-10-11 Thread Nirmoy Das 

Hi Andi,

On 10/11/2023 2:22 PM, Andi Shyti wrote:

Hi Nirmoy,

On Wed, Oct 11, 2023 at 01:54:51PM +0200, Nirmoy Das wrote:

If measure_breadcrumb_dw() returns an error and bce isn't created,
this commit ensures that intel_engine_destroy_pinned_context()
is not called with a NULL bce.

Fixes: b35274993680 ("drm/i915: Create a kernel context for GGTT updates")
Cc: Oak Zeng 
Cc: Andi Shyti 
Signed-off-by: Nirmoy Das 

Reviewed-by: Andi Shyti 


Resent with a fixed subject. Please check again.


Thanks,

Nirmoy



Andi

Re: [Intel-gfx] [PATCH] drm/i915: Prevent potential UAF in engine_init_common

2023-10-11 Thread Andi Shyti 
Hi Nirmoy,

On Wed, Oct 11, 2023 at 01:54:51PM +0200, Nirmoy Das wrote:
> If measure_breadcrumb_dw() returns an error and bce isn't created,
> this commit ensures that intel_engine_destroy_pinned_context()
> is not called with a NULL bce.
> 
> Fixes: b35274993680 ("drm/i915: Create a kernel context for GGTT updates")
> Cc: Oak Zeng 
> Cc: Andi Shyti 
> Signed-off-by: Nirmoy Das 

Reviewed-by: Andi Shyti  

Andi

Re: [Intel-gfx] [PATCH] drm/i915: Prevent potential UAF in engine_init_common

2023-10-11 Thread Nirmoy Das 



On 10/11/2023 2:20 PM, Jani Nikula wrote:

On Wed, 11 Oct 2023, Nirmoy Das  wrote:

If measure_breadcrumb_dw() returns an error and bce isn't created,
this commit ensures that intel_engine_destroy_pinned_context()
is not called with a NULL bce.

So it's a potential NULL pointer dereference, not use after free like
the subject says. Please fix the subject.


ah right. I will resend.


Thanks,

Nirmoy



BR,
Jani.



Fixes: b35274993680 ("drm/i915: Create a kernel context for GGTT updates")
Cc: Oak Zeng 
Cc: Andi Shyti 
Signed-off-by: Nirmoy Das 
---
  drivers/gpu/drm/i915/gt/intel_engine_cs.c | 3 ++-
  1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c 
b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
index 179d9546865b..4a11219e560e 100644
--- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c
+++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
@@ -1491,7 +1491,8 @@ static int engine_init_common(struct intel_engine_cs 
*engine)
return 0;
  
  err_bce_context:

-   intel_engine_destroy_pinned_context(bce);
+   if (bce)
+   intel_engine_destroy_pinned_context(bce);
  err_ce_context:
intel_engine_destroy_pinned_context(ce);
return ret;

Re: [Intel-gfx] [PATCH] drm/i915: Prevent potential UAF in engine_init_common

2023-10-11 Thread Jani Nikula 
On Wed, 11 Oct 2023, Nirmoy Das  wrote:
> If measure_breadcrumb_dw() returns an error and bce isn't created,
> this commit ensures that intel_engine_destroy_pinned_context()
> is not called with a NULL bce.

So it's a potential NULL pointer dereference, not use after free like
the subject says. Please fix the subject.

BR,
Jani.


>
> Fixes: b35274993680 ("drm/i915: Create a kernel context for GGTT updates")
> Cc: Oak Zeng 
> Cc: Andi Shyti 
> Signed-off-by: Nirmoy Das 
> ---
>  drivers/gpu/drm/i915/gt/intel_engine_cs.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c 
> b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
> index 179d9546865b..4a11219e560e 100644
> --- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c
> +++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
> @@ -1491,7 +1491,8 @@ static int engine_init_common(struct intel_engine_cs 
> *engine)
>   return 0;
>  
>  err_bce_context:
> - intel_engine_destroy_pinned_context(bce);
> + if (bce)
> + intel_engine_destroy_pinned_context(bce);
>  err_ce_context:
>   intel_engine_destroy_pinned_context(ce);
>   return ret;

-- 
Jani Nikula, Intel

[Intel-gfx] [PATCH] drm/i915: Prevent potential UAF in engine_init_common

2023-10-11 Thread Nirmoy Das 
If measure_breadcrumb_dw() returns an error and bce isn't created,
this commit ensures that intel_engine_destroy_pinned_context()
is not called with a NULL bce.

Fixes: b35274993680 ("drm/i915: Create a kernel context for GGTT updates")
Cc: Oak Zeng 
Cc: Andi Shyti 
Signed-off-by: Nirmoy Das 
---
 drivers/gpu/drm/i915/gt/intel_engine_cs.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c 
b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
index 179d9546865b..4a11219e560e 100644
--- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c
+++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
@@ -1491,7 +1491,8 @@ static int engine_init_common(struct intel_engine_cs 
*engine)
return 0;
 
 err_bce_context:
-   intel_engine_destroy_pinned_context(bce);
+   if (bce)
+   intel_engine_destroy_pinned_context(bce);
 err_ce_context:
intel_engine_destroy_pinned_context(ce);
return ret;
-- 
2.41.0