]> www.infradead.org Git - users/jedix/linux-maple.git/commit
drm/xe/hwmon: fix uaf on unload
authorMatthew Auld <matthew.auld@intel.com>
Thu, 5 Oct 2023 16:38:55 +0000 (17:38 +0100)
committerRodrigo Vivi <rodrigo.vivi@intel.com>
Thu, 21 Dec 2023 16:42:10 +0000 (11:42 -0500)
commit3a13c2de442d6bfaef9c102cd1092e6cae22b753
tree1a1afbf10aa2c874d99c97c324454f6c66cc286a
parent5708a1080a2e455ca9f35e372f107d0c030358de
drm/xe/hwmon: fix uaf on unload

It doesn't look like you can mix and match devm_ and drmmm_ for a
managed resource. For drmmm the resources are all tracked in drm with
its own list, and there is only one devm_ resource for the entire list.
If the driver itself also adds some of its own devm resources, then
those will be released first. In the case of hwmon the devm_kzalloc will
be freed before the drmmm_ action to destroy the mutex allocated within,
leading to uaf.

Since hwmon itself wants to use devm, rather use that for the mutex
destroy.

Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/766
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Cc: Badal Nilawar <badal.nilawar@intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
drivers/gpu/drm/xe/xe_hwmon.c