• Nirmoy Das's avatar
    drm/i915: Fix a VMA UAF for multi-gt platform · f56fe3e9
    Nirmoy Das authored
    Ensure correct handling of closed VMAs on multi-gt platforms to prevent
    Use-After-Free. Currently, when GT0 goes idle, closed VMAs that are
    exclusively added to GT0's closed_vma link (gt->closed_vma) and
    subsequently freed by i915_vma_parked(), which assumes the entire GPU is
    idle. However, on platforms with multiple GTs, such as MTL, GT1 may
    remain active while GT0 is idle. This causes GT0 to mistakenly consider
    the closed VMAs in its closed_vma list as unnecessary, potentially
    leading to Use-After-Free issues if a job for GT1 attempts to access a
    freed VMA.
    
    Although we do take a wakeref for GT0 but it happens later, after
    evaluating VMAs. To mitigate this, it is necessary to hold a GT0 wakeref
    early.
    
    v2: Use gt id to detect multi-tile(Andi)
        Fix the incorrect error path.
    v3: Add more comment(Andi)
        Use the new gt var when possible(Andrzej)
    
    Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
    Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
    Cc: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com>
    Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
    Cc: Chris Wilson <chris.p.wilson@intel.com>
    Cc: Andi Shyti <andi.shyti@linux.intel.com>
    Cc: Andrzej Hajda <andrzej.hajda@intel.com>
    Cc: Sushma Venkatesh Reddy <sushma.venkatesh.reddy@intel.com>
    Signed-off-by: default avatarNirmoy Das <nirmoy.das@intel.com>
    Tested-by: default avatarAndi Shyti <andi.shyti@linux.intel.com>
    Reviewed-by: default avatarAndi Shyti <andi.shyti@linux.intel.com>
    Reviewed-by: default avatarAndrzej Hajda <andrzej.hajda@intel.com>
    Tested-by: default avatarSushma Venkatesh Reddy <sushma.venkatesh.reddy@intel.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20230608110103.777594-1-andi.shyti@linux.intel.com
    f56fe3e9
i915_gem_execbuffer.c 93.5 KB