drm/i915: Avoid potential vm use-after-free
authorRob Clark <robdclark@chromium.org>
Thu, 19 Jan 2023 17:32:58 +0000 (09:32 -0800)
committerRodrigo Vivi <rodrigo.vivi@intel.com>
Mon, 30 Jan 2023 20:48:08 +0000 (15:48 -0500)
commit41d419382ec7e257e54b7b6ff0d3623aafb1316d
treeb6cf4aff0a181e24eeb2994cfea2cd0c9c691cc0
parent6d796c50f84ca79f1722bb131799e5a5710c4700
drm/i915: Avoid potential vm use-after-free

Adding the vm to the vm_xa table makes it visible to userspace, which
could try to race with us to close the vm.  So we need to take our extra
reference before putting it in the table.

Signed-off-by: Rob Clark <robdclark@chromium.org>
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
Fixes: 9ec8795e7d91 ("drm/i915: Drop __rcu from gem_context->vm")
Cc: <stable@vger.kernel.org> # v5.16+
Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230119173321.2825472-1-robdclark@gmail.com
(cherry picked from commit 99343c46d4e2b34c285d3d5f68ff04274c2f9fb4)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
drivers/gpu/drm/i915/gem/i915_gem_context.c