drm/xe/migrate: prevent potential UAF

If we hit the error path, the previous fence (if there is one) has
already been put() prior to this, so doing a fence_wait could lead to
UAF. Tweak the flow to do to the put() until after we do the wait.

Fixes: 270172f64b11 ("drm/xe: Update xe_ttm_access_memory to use GPU for non-visible access")
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Cc: Maciej Patelczyk <maciej.patelczyk@intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: Stuart Summers <stuart.summers@intel.com>
Link: https://lore.kernel.org/r/20250731093807.207572-8-matthew.auld@intel.com
(cherry picked from commit 9b7ca35ed28fe5fad86e9d9c24ebd1271e4c9c3e)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>

diff --git a/drivers/gpu/drm/xe/xe_migrate.c b/drivers/gpu/drm/xe/xe_migrate.c
index 95bcaa427d261217ab260fdd4e41c82231e0ae2d..7d20ac4bb63336925516720fe0573d7f81b0bbdf 100644 (file)
--- a/drivers/gpu/drm/xe/xe_migrate.c
+++ b/drivers/gpu/drm/xe/xe_migrate.c
@@ -1893,9 +1893,6 @@ int xe_migrate_access_memory(struct xe_migrate *m, struct xe_bo *bo,
                        current_bytes = min_t(int, current_bytes, S16_MAX * pitch);
                }
 
-               if (fence)
-                       dma_fence_put(fence);
-
                __fence = xe_migrate_vram(m, current_bytes,
                                          (unsigned long)buf & ~PAGE_MASK,
                                          dma_addr + current_page,
@@ -1903,11 +1900,15 @@ int xe_migrate_access_memory(struct xe_migrate *m, struct xe_bo *bo,
                                          XE_MIGRATE_COPY_TO_VRAM :
                                          XE_MIGRATE_COPY_TO_SRAM);
                if (IS_ERR(__fence)) {
-                       if (fence)
+                       if (fence) {
                                dma_fence_wait(fence, false);
+                               dma_fence_put(fence);
+                       }
                        fence = __fence;
                        goto out_err;
                }
+
+               dma_fence_put(fence);
                fence = __fence;
 
                buf += current_bytes;