Commit 67801fa6 authored by Matthew Auld's avatar Matthew Auld Committed by Lucas De Marchi
Browse files

drm/xe/queue: move xa_alloc to prevent UAF



Evil user can guess the next id of the queue before the ioctl completes
and then call queue destroy ioctl to trigger UAF since create ioctl is
still referencing the same queue. Move the xa_alloc all the way to the end
to prevent this.

v2:
 - Rebase

Fixes: 2149ded6 ("drm/xe: Fix use after free when client stats are captured")
Signed-off-by: default avatarMatthew Auld <matthew.auld@intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: default avatarNirmoy Das <nirmoy.das@intel.com>
Reviewed-by: default avatarMatthew Brost <matthew.brost@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240925071426.144015-4-matthew.auld@intel.com


(cherry picked from commit 16536582)
Signed-off-by: default avatarLucas De Marchi <lucas.demarchi@intel.com>
parent 74231870
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment