drm/scheduler: Fix UAF race in drm_sched_entity_push_job()

Browse source

After a job is pushed into the queue, it is owned by the scheduler core
and may be freed at any time, so we can't write nor read the submit
timestamp after that point.

Fixes oopses observed with the drm/asahi driver, found with kASAN.

Signed-off-by: Asahi Lina <lina@asahilina.net>
Link: https://lore.kernel.org/r/20230406-scheduler-uaf-2-v1-1-972531cf0a81@asahilina.net
Reviewed-by: Luben Tuikov <luben.tuikov@amd.com>
Signed-off-by: Luben Tuikov <luben.tuikov@amd.com>

...

This commit is contained in:

Asahi Lina 2023-04-06 01:37:39 +09:00 • committed by Luben Tuikov

parent 1f0d40d88f

commit 5a94aa77bb

1 changed files with 9 additions and 2 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

11

drivers/gpu/drm/scheduler/sched_entity.c

View file