drm/scheduler: Fix UAF race in drm_sched_entity_push_job()
authorAsahi Lina <lina@asahilina.net>
Wed, 5 Apr 2023 16:37:39 +0000 (01:37 +0900)
committerLuben Tuikov <luben.tuikov@amd.com>
Thu, 6 Apr 2023 21:10:02 +0000 (17:10 -0400)
commit5a94aa77bb7f970c6ae35cd7537121501f015a7f
tree532bfe22d4a53eea60efa5427223d68714a28e86
parent1f0d40d88f7aeaeb4316fe86ffa04a295954b918
drm/scheduler: Fix UAF race in drm_sched_entity_push_job()

After a job is pushed into the queue, it is owned by the scheduler core
and may be freed at any time, so we can't write nor read the submit
timestamp after that point.

Fixes oopses observed with the drm/asahi driver, found with kASAN.

Signed-off-by: Asahi Lina <lina@asahilina.net>
Link: https://lore.kernel.org/r/20230406-scheduler-uaf-2-v1-1-972531cf0a81@asahilina.net
Reviewed-by: Luben Tuikov <luben.tuikov@amd.com>
Signed-off-by: Luben Tuikov <luben.tuikov@amd.com>
drivers/gpu/drm/scheduler/sched_entity.c