Matthew Auld ca7c52ac7a drm/xe/vm: prevent UAF with asid based lookup ... The asid is only erased from the xarray when the vm refcount reaches zero, however this leads to potential UAF since the xe_vm_get() only works on a vm with refcount != 0. Since the asid is allocated in the vm create ioctl, rather erase it when closing the vm, prior to dropping the potential last ref. This should also work when user closes driver fd without explicit vm destroy. Fixes: dd08ebf6c3 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/1594 Signed-off-by: Matthew Auld <matthew.auld@intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Cc: <stable@vger.kernel.org> # v6.8+ Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240412113144.259426-4-matthew.auld@intel.com (cherry picked from commit 83967c5732) Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>		2024-04-17 08:03:13 -05:00
..
abi	drm/xe: Make all GuC ABI shift values unsigned	2024-02-01 11:34:59 +01:00
compat-i915-headers	drm/xe/display: fix i915_gem_object_is_shmem() wrapper	2024-02-15 09:53:11 +01:00
display	drm/xe: Fix bo leak in intel_fb_bo_framebuffer_init	2024-04-17 08:03:06 -05:00
instructions	…
regs	drm/xe: Label RING_CONTEXT_CONTROL as masked	2024-04-11 08:41:54 -05:00
tests	drm for 6.9:	2024-03-13 18:34:05 -07:00
.gitignore	…
.kunitconfig	…
Kconfig	drm/xe/kunit: fix link failure with built-in xe	2024-03-04 08:41:11 -06:00
Kconfig.debug	drm/xe/kunit: fix link failure with built-in xe	2024-03-04 08:41:11 -06:00
Kconfig.profile	…
Makefile	kbuild: make -Woverride-init warnings more consistent	2024-03-31 11:32:26 +09:00
xe_assert.h	…
xe_bb.c	…
xe_bb.h	…
xe_bb_types.h	…
xe_bo.c	drm/xe: Remove unused xe_bo->props struct	2024-03-25 13:45:32 -05:00
xe_bo.h	drm/xe/xe_bo_move: Enhance xe_bo_move trace	2024-02-29 10:39:02 +01:00
xe_bo_doc.h	…
xe_bo_evict.c	…
xe_bo_evict.h	…
xe_bo_types.h	drm/xe: Remove unused xe_bo->props struct	2024-03-25 13:45:32 -05:00
xe_debugfs.c	drm/xe/xe_debugfs: Print skip_guc_pc in xe info	2024-01-19 08:28:31 -05:00
xe_debugfs.h	…
xe_devcoredump.c	drm/xe: Implement VM snapshot support for BO's and userptr	2024-02-21 20:08:57 +01:00
xe_devcoredump.h	drm/xe: Change devcoredump functions parameters to xe_sched_job	2024-01-24 10:53:38 -08:00
xe_devcoredump_types.h	drm/xe: Implement VM snapshot support for BO's and userptr	2024-02-21 20:08:57 +01:00
xe_device.c	drm/xe: Use ordered wq for preempt fence waiting	2024-04-04 08:32:34 -05:00
xe_device.h	drm/xe/device: fix XE_MAX_TILES_PER_DEVICE check	2024-03-25 13:45:32 -05:00
xe_device_sysfs.c	…
xe_device_sysfs.h	…
xe_device_types.h	drm/xe: Use ordered wq for preempt fence waiting	2024-04-04 08:32:34 -05:00
xe_dma_buf.c	drm/xe/dmabuf: Make xe_dmabuf_ops static	2024-01-24 11:12:45 +01:00
xe_dma_buf.h	…
xe_drm_client.c	drm/xe/xe_bo_move: Enhance xe_bo_move trace	2024-02-29 10:39:02 +01:00
xe_drm_client.h	…
xe_drv.h	…
xe_exec.c	drm/xe: Move vma rebinding to the drm_exec locking loop	2024-04-04 08:32:31 -05:00
xe_exec.h	…
xe_exec_queue.c	drm/xe/queue: fix engine_class bounds check	2024-03-25 13:45:32 -05:00
xe_exec_queue.h	drm/xe: Finish refactoring of exec_queue_create	2024-01-10 15:01:53 -08:00
xe_exec_queue_types.h	drm/xe: Use ring ops TLB invalidation for rebinds	2024-04-04 08:32:22 -05:00
xe_execlist.c	drm for 6.9:	2024-03-13 18:34:05 -07:00
xe_execlist.h	…
xe_execlist_types.h	…
xe_force_wake.c	…
xe_force_wake.h	…
xe_force_wake_types.h	…
xe_gen_wa_oob.c	…
xe_ggtt.c	drm/xe/vf: Assume fixed GSM size if VF	2024-02-13 18:59:47 +01:00
xe_ggtt.h	drm/xe: Allow to exclude part of GGTT from allocations	2024-01-12 11:49:16 +01:00
xe_ggtt_types.h	…
xe_gpu_scheduler.c	…
xe_gpu_scheduler.h	…
xe_gpu_scheduler_types.h	…
xe_gsc.c	drm/xe: Do not include current dir for generated/xe_wa_oob.h	2024-02-21 21:53:15 -08:00
xe_gsc.h	drm/xe/gsc: Initialize GSC proxy	2024-01-18 11:04:34 -08:00
xe_gsc_proxy.c	drm/xe/gsc: add support for GSC proxy interrupt	2024-01-18 11:04:37 -08:00
xe_gsc_proxy.h	drm/xe/gsc: add support for GSC proxy interrupt	2024-01-18 11:04:37 -08:00
xe_gsc_submit.c	drm/xe/gsc: Add status check during gsc header readout	2024-02-01 13:25:47 -08:00
xe_gsc_submit.h	drm/xe/gsc: Initialize GSC proxy	2024-01-18 11:04:34 -08:00
xe_gsc_types.h	drm/xe: Document nested struct members according to guidelines	2024-01-23 16:54:41 +01:00
xe_gt.c	drm/xe/guc: Fix missing topology init	2024-03-04 08:41:17 -06:00
xe_gt.h	drm/xe: Initialize GuC earlier during probe	2024-02-20 14:13:47 -05:00
xe_gt_ccs_mode.c	…
xe_gt_ccs_mode.h	…
xe_gt_clock.c	…
xe_gt_clock.h	…
xe_gt_debugfs.c	…
xe_gt_debugfs.h	…
xe_gt_freq.c	drm/xe: Check skip_guc_pc before setting SLPC flag	2024-01-15 15:36:52 +01:00
xe_gt_freq.h	…
xe_gt_idle.c	drm/xe/xe_gt_idle: Drop redundant newline in name	2024-02-21 10:38:59 +01:00
xe_gt_idle.h	…
xe_gt_idle_types.h	…
xe_gt_mcr.c	drm/xe/vf: Don't support MCR registers if VF	2024-02-13 18:59:54 +01:00
xe_gt_mcr.h	…
xe_gt_pagefault.c	drm/xe: Move vma rebinding to the drm_exec locking loop	2024-04-04 08:32:31 -05:00
xe_gt_pagefault.h	…
xe_gt_printk.h	…
xe_gt_sriov_printk.h	drm/xe: Introduce GT-oriented SR-IOV logging macros	2024-01-05 16:25:53 +01:00
xe_gt_sysfs.c	…
xe_gt_sysfs.h	…
xe_gt_sysfs_types.h	…
xe_gt_throttle_sysfs.c	…
xe_gt_throttle_sysfs.h	…
xe_gt_tlb_invalidation.c	drm/xe: Make TLB invalidation fences unordered	2024-04-04 08:32:28 -05:00
xe_gt_tlb_invalidation.h	…
xe_gt_tlb_invalidation_types.h	…
xe_gt_topology.c	drm/xe: switch from drm_debug_printer() to device specific drm_dbg_printer()	2024-02-09 11:52:28 +02:00
xe_gt_topology.h	…
xe_gt_types.h	drm/xe: Make TLB invalidation fences unordered	2024-04-04 08:32:28 -05:00
xe_guc.c	drm/xe: Do not include current dir for generated/xe_wa_oob.h	2024-02-21 21:53:15 -08:00
xe_guc.h	drm/xe: Split GuC communication initialization	2024-01-11 19:14:19 +01:00
xe_guc_ads.c	drm/xe/guc: Allocate GuC data structures in system memory for initial load	2024-02-20 14:13:42 -05:00
xe_guc_ads.h	…
xe_guc_ads_types.h	…
xe_guc_ct.c	drm/xe/guc: Allocate GuC data structures in system memory for initial load	2024-02-20 14:13:42 -05:00
xe_guc_ct.h	drm/xe/guc: Add more GuC CT states	2024-01-26 15:12:28 -05:00
xe_guc_ct_types.h	drm/xe/guc: Add more GuC CT states	2024-01-26 15:12:28 -05:00
xe_guc_db_mgr.c	drm/xe: Fix potential deadlock in __fini_dbm	2024-01-12 11:53:05 +01:00
xe_guc_db_mgr.h	…
xe_guc_debugfs.c	…
xe_guc_debugfs.h	…
xe_guc_exec_queue_types.h	…
xe_guc_fwif.h	drm/xe/guc: Enable WA 14018913170	2024-01-18 09:05:37 -05:00
xe_guc_hwconfig.c	drm/xe/guc: Allocate GuC data structures in system memory for initial load	2024-02-20 14:13:42 -05:00
xe_guc_hwconfig.h	…
xe_guc_hxg_helpers.h	drm/xe/guc: Add helpers for HXG messages	2024-01-05 16:25:53 +01:00
xe_guc_log.c	drm/xe/guc: Allocate GuC data structures in system memory for initial load	2024-02-20 14:13:42 -05:00
xe_guc_log.h	…
xe_guc_log_types.h	…
xe_guc_pc.c	drm/xe/guc: Move GuC power control init to "post-hwconfig"	2024-02-20 14:13:46 -05:00
xe_guc_pc.h	drm/xe/guc: Move GuC power control init to "post-hwconfig"	2024-02-20 14:13:46 -05:00
xe_guc_pc_types.h	…
xe_guc_relay.c	drm/xe: Fix compilation without CONFIG_KUNIT	2024-01-05 21:28:09 +01:00
xe_guc_relay.h	drm/xe/guc: Introduce Relay Communication for SR-IOV	2024-01-05 16:25:53 +01:00
xe_guc_relay_types.h	drm/xe/guc: Introduce Relay Communication for SR-IOV	2024-01-05 16:25:53 +01:00
xe_guc_submit.c	drm/xe/guc_submit: use jiffies for job timeout	2024-03-25 13:45:32 -05:00
xe_guc_submit.h	drm/xe: Change devcoredump functions parameters to xe_sched_job	2024-01-24 10:53:38 -08:00
xe_guc_submit_types.h	drm/xe: Document nested struct members according to guidelines	2024-01-23 16:54:41 +01:00
xe_guc_types.h	drm/xe: Document nested struct members according to guidelines	2024-01-23 16:54:41 +01:00
xe_heci_gsc.c	drm/xe: make heci_gsc_irq_chip const	2024-01-19 14:35:31 +02:00
xe_heci_gsc.h	…
xe_huc.c	drm/xe/huc: Realloc HuC FW in vram for post-hwconfig	2024-02-20 14:13:45 -05:00
xe_huc.h	drm/xe/huc: Realloc HuC FW in vram for post-hwconfig	2024-02-20 14:13:45 -05:00
xe_huc_debugfs.c	…
xe_huc_debugfs.h	…
xe_huc_types.h	…
xe_hw_engine.c	drm/xe/vf: Don't try to capture engine data unavailable to VF	2024-02-13 18:59:48 +01:00
xe_hw_engine.h	…
xe_hw_engine_class_sysfs.c	drm/xe: constify engine class sysfs attributes	2024-01-19 14:36:04 +02:00
xe_hw_engine_class_sysfs.h	…
xe_hw_engine_types.h	drm/xe: Print registers spread in 2 u32 as u64	2024-01-24 11:08:25 -08:00
xe_hw_fence.c	drm/xe: Fix crash in trace_dma_fence_init()	2024-02-01 11:25:45 +01:00
xe_hw_fence.h	…
xe_hw_fence_types.h	…
xe_hwmon.c	drm/xe/hwmon: Cast result to output precision on left shift of operand	2024-04-11 08:41:53 -05:00
xe_hwmon.h	…
xe_irq.c	drm/xe: use drm based debugging instead of dev	2024-02-12 20:28:11 +02:00
xe_irq.h	…
xe_lmtt.c	…
xe_lmtt.h	…
xe_lmtt_2l.c	…
xe_lmtt_ml.c	…
xe_lmtt_types.h	…
xe_lrc.c	drm/xe: Label RING_CONTEXT_CONTROL as masked	2024-04-11 08:41:54 -05:00
xe_lrc.h	…
xe_lrc_types.h	drm/xe: Document nested struct members according to guidelines	2024-01-23 16:54:41 +01:00
xe_macros.h	…
xe_map.h	…
xe_memirq.c	…
xe_memirq.h	…
xe_memirq_types.h	…
xe_migrate.c	drm/xe/xe_migrate: Cast to output precision before multiplying operands	2024-04-11 08:41:53 -05:00
xe_migrate.h	…
xe_migrate_doc.h	…
xe_mmio.c	drm for 6.9:	2024-03-13 18:34:05 -07:00
xe_mmio.h	…
xe_mocs.c	drm/xe/vf: Don't program MOCS if VF	2024-02-13 18:59:49 +01:00
xe_mocs.h	…
xe_module.c	…
xe_module.h	…
xe_pat.c	drm/xe/vf: Don't program PAT if VF	2024-02-13 18:59:53 +01:00
xe_pat.h	…
xe_pci.c	drm/xe: drop display/ subdir from include directories	2024-01-31 14:59:07 +02:00
xe_pci.h	…
xe_pci_types.h	…
xe_pcode.c	…
xe_pcode.h	…
xe_pcode_api.h	drm/xe: Add vram frequency sysfs attributes	2024-01-09 17:47:24 -05:00
xe_platform_types.h	…
xe_pm.c	drm for 6.9:	2024-03-13 18:34:05 -07:00
xe_pm.h	drm/xe/dgfx: Release mmap mappings on rpm suspend	2024-01-08 16:55:44 -05:00
xe_preempt_fence.c	drm/xe: Use ordered wq for preempt fence waiting	2024-04-04 08:32:34 -05:00
xe_preempt_fence.h	…
xe_preempt_fence_types.h	…
xe_pt.c	drm/xe: Move vma rebinding to the drm_exec locking loop	2024-04-04 08:32:31 -05:00
xe_pt.h	…
xe_pt_types.h	…
xe_pt_walk.c	drm/xe/pt: Allow for stricter type- and range checking	2024-02-15 09:53:18 +01:00
xe_pt_walk.h	drm/xe/pt: Allow for stricter type- and range checking	2024-02-15 09:53:18 +01:00
xe_query.c	drm/xe/query: fix gt_id bounds check	2024-03-25 13:45:32 -05:00
xe_query.h	…
xe_range_fence.c	drm/xe: avoid function cast warnings	2024-02-15 09:53:38 +01:00
xe_range_fence.h	…
xe_reg_sr.c	drm/xe: switch from drm_debug_printer() to device specific drm_dbg_printer()	2024-02-09 11:52:28 +02:00
xe_reg_sr.h	…
xe_reg_sr_types.h	…
xe_reg_whitelist.c	drm/xe/xe2: Add workaround 16020183090	2023-12-26 22:22:04 -08:00
xe_reg_whitelist.h	…
xe_res_cursor.h	…
xe_ring_ops.c	drm/xe: Use ring ops TLB invalidation for rebinds	2024-04-04 08:32:22 -05:00
xe_ring_ops.h	…
xe_ring_ops_types.h	…
xe_rtp.c	…
xe_rtp.h	…
xe_rtp_helpers.h	…
xe_rtp_types.h	…
xe_sa.c	…
xe_sa.h	…
xe_sa_types.h	…
xe_sched_job.c	drm/xe: Use ring ops TLB invalidation for rebinds	2024-04-04 08:32:22 -05:00
xe_sched_job.h	drm/xe: Add batch buffer addresses to devcoredump	2024-01-30 11:53:47 -08:00
xe_sched_job_types.h	drm/xe: Use ring ops TLB invalidation for rebinds	2024-04-04 08:32:22 -05:00
xe_sriov.c	drm/xe: Allocate dedicated workqueue for SR-IOV workers	2024-01-05 16:25:52 +01:00
xe_sriov.h	drm/xe: Allocate dedicated workqueue for SR-IOV workers	2024-01-05 16:25:52 +01:00
xe_sriov_printk.h	…
xe_sriov_types.h	drm/xe: Define Virtual Function Identifier	2024-01-05 16:25:52 +01:00
xe_step.c	…
xe_step.h	…
xe_step_types.h	…
xe_sync.c	drm/xe: Expose user fence from xe_sync_entry	2024-02-29 10:39:02 +01:00
xe_sync.h	drm/xe: Expose user fence from xe_sync_entry	2024-02-29 10:39:02 +01:00
xe_sync_types.h	drm/xe: Expose user fence from xe_sync_entry	2024-02-29 10:39:02 +01:00
xe_tile.c	drm/xe: Return immediately on tile_init failure	2024-03-07 09:13:38 +01:00
xe_tile.h	…
xe_tile_sysfs.c	drm/xe: Add vram frequency sysfs attributes	2024-01-09 17:47:24 -05:00
xe_tile_sysfs.h	…
xe_tile_sysfs_types.h	…
xe_trace.c	…
xe_trace.h	drm fixes for 6.9-rc1	2024-03-21 19:04:31 -07:00
xe_ttm_stolen_mgr.c	drm/xe: Do not include current dir for generated/xe_wa_oob.h	2024-02-21 21:53:15 -08:00
xe_ttm_stolen_mgr.h	…
xe_ttm_sys_mgr.c	…
xe_ttm_sys_mgr.h	…
xe_ttm_vram_mgr.c	…
xe_ttm_vram_mgr.h	…
xe_ttm_vram_mgr_types.h	…
xe_tuning.c	drm/xe/xe2_lpg: Introduce performance guide changes	2024-01-23 07:41:00 -08:00
xe_tuning.h	…
xe_uc.c	drm/xe: Initialize GuC earlier during probe	2024-02-20 14:13:47 -05:00
xe_uc.h	drm/xe/gsc: Initialize GSC proxy	2024-01-18 11:04:34 -08:00
xe_uc_debugfs.c	…
xe_uc_debugfs.h	…
xe_uc_fw.c	drm/xe: Avoid cryptic message when there's no GuC definition	2024-02-07 15:08:21 -08:00
xe_uc_fw.h	…
xe_uc_fw_abi.h	…
xe_uc_fw_types.h	drm/xe: Document nested struct members according to guidelines	2024-01-23 16:54:41 +01:00
xe_uc_types.h	…
xe_vm.c	drm/xe/vm: prevent UAF with asid based lookup	2024-04-17 08:03:13 -05:00
xe_vm.h	drm/xe: Move vma rebinding to the drm_exec locking loop	2024-04-04 08:32:31 -05:00
xe_vm_doc.h	…
xe_vm_types.h	drm/xe: Rework rebinding	2024-04-04 08:32:26 -05:00
xe_vram_freq.c	drm/xe: Return if kobj creation is failed	2024-03-14 14:29:38 -05:00
xe_vram_freq.h	drm/xe: Add vram frequency sysfs attributes	2024-01-09 17:47:24 -05:00
xe_wa.c	drm/xe: Do not include current dir for generated/xe_wa_oob.h	2024-02-21 21:53:15 -08:00
xe_wa.h	…
xe_wa_oob.rules	drm/xe/guc: Enable WA 14018913170	2024-01-18 09:05:37 -05:00
xe_wait_user_fence.c	drm/xe: Fix spelling mistake "gueue" -> "queue"	2024-01-08 07:43:31 -08:00
xe_wait_user_fence.h	…
xe_wopcm.c	…
xe_wopcm.h	…
xe_wopcm_types.h	drm/xe: Document nested struct members according to guidelines	2024-01-23 16:54:41 +01:00