Re: [PATCH] drm/imagination: take paired job reference
From: Matt Coster
Date: Mon Mar 24 2025 - 10:51:03 EST
On 18/03/2025 14:53, Brendan King via B4 Relay wrote:
> From: Brendan King <Brendan.King@xxxxxxxxxx>
>
> For paired jobs, have the fragment job take a reference on the
> geometry job, so that the geometry job cannot be freed until
> the fragment job has finished with it.
>
> The geometry job structure is accessed when the fragment job is being
> prepared by the GPU scheduler. Taking the reference prevents the
> geometry job being freed until the fragment job no longer requires it.
>
> Fixes a use after free bug detected by KASAN:
>
> [ 124.256386] BUG: KASAN: slab-use-after-free in pvr_queue_prepare_job+0x108/0x868 [powervr]
> [ 124.264893] Read of size 1 at addr ffff0000084cb960 by task kworker/u16:4/63
>
> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: eaf01ee5ba28 ("drm/imagination: Implement job submission and scheduling")
> Signed-off-by: Brendan King <brendan.king@xxxxxxxxxx>
Reviewed-by: Matt Coster <matt.coster@xxxxxxxxxx>
I'll apply this to drm-misc-fixed tomorrow if there are no objections.
> ---
> drivers/gpu/drm/imagination/pvr_job.c | 7 +++++++
> drivers/gpu/drm/imagination/pvr_queue.c | 4 ++++
> 2 files changed, 11 insertions(+)
>
> diff --git a/drivers/gpu/drm/imagination/pvr_job.c b/drivers/gpu/drm/imagination/pvr_job.c
> index 1cdb3cfd058d7db573337a2b4f6895ee4922f9a9..59b334d094fa826f26668d98561e956ec9c51428 100644
> --- a/drivers/gpu/drm/imagination/pvr_job.c
> +++ b/drivers/gpu/drm/imagination/pvr_job.c
> @@ -671,6 +671,13 @@ pvr_jobs_link_geom_frag(struct pvr_job_data *job_data, u32 *job_count)
> geom_job->paired_job = frag_job;
> frag_job->paired_job = geom_job;
>
> + /* The geometry job pvr_job structure is used when the fragment
> + * job is being prepared by the GPU scheduler. Have the fragment
> + * job hold a reference on the geometry job to prevent it being
> + * freed until the fragment job has finished with it.
> + */
> + pvr_job_get(geom_job);
> +
> /* Skip the fragment job we just paired to the geometry job. */
> i++;
> }
> diff --git a/drivers/gpu/drm/imagination/pvr_queue.c b/drivers/gpu/drm/imagination/pvr_queue.c
> index 21c185d18bb2e0569bd6e12832a74e38137bd48a..6431f6b654a2e60b86a46bd8571eb9f8133c4b53 100644
> --- a/drivers/gpu/drm/imagination/pvr_queue.c
> +++ b/drivers/gpu/drm/imagination/pvr_queue.c
> @@ -856,6 +856,10 @@ static void pvr_queue_free_job(struct drm_sched_job *sched_job)
> struct pvr_job *job = container_of(sched_job, struct pvr_job, base);
>
> drm_sched_job_cleanup(sched_job);
> +
> + if (job->type == DRM_PVR_JOB_TYPE_FRAGMENT && job->paired_job)
> + pvr_job_put(job->paired_job);
> +
> job->paired_job = NULL;
> pvr_job_put(job);
> }
>
> ---
> base-commit: 96c85e428ebaeacd2c640eba075479ab92072ccd
> change-id: 20250318-ddkopsrc-1337-use-after-free-in-pvr_queue_prepare_job-16fbc74b0c20
>
> Best regards,
--
Matt Coster
E: matt.coster@xxxxxxxxxx
Attachment:
OpenPGP_signature.asc
Description: OpenPGP digital signature