Skip to content

Commit

Permalink
drm/i915/gt: Empty uabi engines list during intel_engines_release()
Browse files Browse the repository at this point in the history
While the uabi_engines_llist is populated in intel_engines_init() during
driver load, the corresponding function intel_engines_release() does not
correctly get rid of it. This can lead to a UAF if, after failed
initialization (for example when gt is set wedged on init), we try to
access the engines.

Suggested-by: Chris Wilson <chris.p.wilson@linux.intel.com>
Signed-off-by: Krzysztof Niemiec <krzysztof.niemiec@intel.com>
Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
Signed-off-by: Andi Shyti <andi.shyti@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240801154047.115176-2-krzysztof.niemiec@intel.com
  • Loading branch information
k-niemiec authored and Andi Shyti committed Aug 5, 2024
1 parent 843f10c commit fceff12
Showing 1 changed file with 2 additions and 0 deletions.
2 changes: 2 additions & 0 deletions drivers/gpu/drm/i915/gt/intel_engine_cs.c
Original file line number Diff line number Diff line change
Expand Up @@ -693,6 +693,8 @@ void intel_engines_release(struct intel_gt *gt)

memset(&engine->reset, 0, sizeof(engine->reset));
}

llist_del_all(&gt->i915->uabi_engines_llist);
}

void intel_engine_free_request_pool(struct intel_engine_cs *engine)
Expand Down

0 comments on commit fceff12

Please sign in to comment.