diff options
| author | Rob Clark <robdclark@chromium.org> | 2023-01-27 12:05:31 -0800 |
|---|---|---|
| committer | Tvrtko Ursulin <tvrtko.ursulin@intel.com> | 2023-01-30 10:10:16 +0000 |
| commit | 10e0cbaaf1104f449d695c80bcacf930dcd3c42e (patch) | |
| tree | 4328cf0145b69794c50919e3ea885f02a2f0adf0 /drivers/gpu/drm/i915/gem/i915_gem_tiling.c | |
| parent | 583ebae783b8241a30581c084ad6226051b594c5 (diff) | |
drm/i915: Fix potential bit_17 double-free
A userspace with multiple threads racing I915_GEM_SET_TILING to set the
tiling to I915_TILING_NONE could trigger a double free of the bit_17
bitmask. (Or conversely leak memory on the transition to tiled.) Move
allocation/free'ing of the bitmask within the section protected by the
obj lock.
Signed-off-by: Rob Clark <robdclark@chromium.org>
Fixes: 2850748ef876 ("drm/i915: Pull i915_vma_pin under the vm->mutex")
Cc: <stable@vger.kernel.org> # v5.5+
[tursulin: Correct fixes tag and added cc stable.]
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230127200550.3531984-1-robdclark@gmail.com
Diffstat (limited to 'drivers/gpu/drm/i915/gem/i915_gem_tiling.c')
| -rw-r--r-- | drivers/gpu/drm/i915/gem/i915_gem_tiling.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_tiling.c b/drivers/gpu/drm/i915/gem/i915_gem_tiling.c index 04bb909acdec..a049ca0b7980 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_tiling.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_tiling.c @@ -305,10 +305,6 @@ i915_gem_object_set_tiling(struct drm_i915_gem_object *obj, spin_unlock(&obj->vma.lock); obj->tiling_and_stride = tiling | stride; - i915_gem_object_unlock(obj); - - /* Force the fence to be reacquired for GTT access */ - i915_gem_object_release_mmap_gtt(obj); /* Try to preallocate memory required to save swizzling on put-pages */ if (i915_gem_object_needs_bit17_swizzle(obj)) { @@ -321,6 +317,11 @@ i915_gem_object_set_tiling(struct drm_i915_gem_object *obj, obj->bit_17 = NULL; } + i915_gem_object_unlock(obj); + + /* Force the fence to be reacquired for GTT access */ + i915_gem_object_release_mmap_gtt(obj); + return 0; } |