drm/xe/svm: Fix a potential bo UAF

If drm_gpusvm_migrate_to_devmem() succeeds, if a cpu access happens to the
range the bo may be freed before xe_bo_unlock(), causing a UAF.

Since the reference is transferred, use xe_svm_devmem_release() to
release the reference on drm_gpusvm_migrate_to_devmem() failure,
and hold a local reference to protect the UAF.

Fixes: 2f118c949160 ("drm/xe: Add SVM VRAM migration")
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://lore.kernel.org/r/20250326080551.40201-3-thomas.hellstrom@linux.intel.com
(cherry picked from commit c9db07cab766b665c8fa1184649cef452f448dc8)
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>

diff --git a/drivers/gpu/drm/xe/xe_svm.c b/drivers/gpu/drm/xe/xe_svm.c
index 3e829c87d7b45a582cd3305937ed0ff912ed71d8..f8c128524d9f33d5cdc2253b3e8b643e7e7eb96a 100644 (file)
--- a/drivers/gpu/drm/xe/xe_svm.c
+++ b/drivers/gpu/drm/xe/xe_svm.c
@@ -696,11 +696,14 @@ retry:
        list_for_each_entry(block, blocks, link)
                block->private = vr;
 
+       xe_bo_get(bo);
        err = drm_gpusvm_migrate_to_devmem(&vm->svm.gpusvm, &range->base,
                                           &bo->devmem_allocation, ctx);
-       xe_bo_unlock(bo);
        if (err)
-               xe_bo_put(bo);  /* Creation ref */
+               xe_svm_devmem_release(&bo->devmem_allocation);
+
+       xe_bo_unlock(bo);
+       xe_bo_put(bo);
 
 unlock:
        mmap_read_unlock(mm);