Both amdgpu_userq_wait_ioctl() and amdgpu_userq_signal_ioctl()
access user queue objects obtained from xa_load() without holding
userq_mutex. A concurrent AMDGPU_USERQ_OP_FREE can destroy and
kfree the queue in this window, leading to use-after-free.
The two bugs have different origins:
- Patch 1 fixes a wait-path regression introduced by commit
4b27406380b0 ("drm/amdgpu: Add queue id support to the user queue
wait IOCTL"), which removed the indirect fence_drv_xa_ptr model
and its NULL-check safety net from commit ed5fdc1fc282
("drm/amdgpu: Fix the use-after-free issue in wait IOCTL").
- Patch 2 fixes a similar pre-existing lifetime bug in the signal
path, present since commit a292fdecd728 ("drm/amdgpu: Implement
userqueue signal/wait IOCTL").
Patch 1 adds explicit userq_mutex coverage around the xa_load and
subsequent fence_drv_xa operations in the wait path.
Patch 2 moves the ensure_ev_fence call (which acquires
userq_mutex) before xa_load in the signal path, so that the queue
lookup and all subsequent accesses are covered by the same lock.
Chenyuan Mi (2):
drm/amdgpu: protect waitq access with userq_mutex in wait IOCTL
drm/amdgpu: protect queue access in signal IOCTL
.../gpu/drm/amd/amdgpu/amdgpu_userq_fence.c | 25 +++++++++++++------
1 file changed, 18 insertions(+), 7 deletions(-)
--
2.53.0
