Re: [PATCH] drm/i915: Fix potential context UAFs

2023-01-06 Thread Tvrtko Ursulin
On 05/01/2023 16:00, Tvrtko Ursulin wrote: On 05/01/2023 15:52, Andi Shyti wrote: Hi Rob, On Tue, Jan 03, 2023 at 03:49:46PM -0800, Rob Clark wrote: From: Rob Clark gem_context_register() makes the context visible to userspace, and which point a separate thread can trigger the I915_GEM_CO

Re: [PATCH] drm/i915: Fix potential context UAFs

2023-01-05 Thread Tvrtko Ursulin
On 05/01/2023 15:52, Andi Shyti wrote: Hi Rob, On Tue, Jan 03, 2023 at 03:49:46PM -0800, Rob Clark wrote: From: Rob Clark gem_context_register() makes the context visible to userspace, and which point a separate thread can trigger the I915_GEM_CONTEXT_DESTROY ioctl. So we need to ensure tha

Re: [PATCH] drm/i915: Fix potential context UAFs

2023-01-05 Thread Andi Shyti
Hi Rob, On Tue, Jan 03, 2023 at 03:49:46PM -0800, Rob Clark wrote: > From: Rob Clark > > gem_context_register() makes the context visible to userspace, and which > point a separate thread can trigger the I915_GEM_CONTEXT_DESTROY ioctl. > So we need to ensure that nothing uses the ctx ptr after t

Re: [PATCH] drm/i915: Fix potential context UAFs

2023-01-04 Thread Rob Clark
On Wed, Jan 4, 2023 at 1:34 AM Tvrtko Ursulin wrote: > > > On 03/01/2023 23:49, Rob Clark wrote: > > From: Rob Clark > > > > gem_context_register() makes the context visible to userspace, and which > > point a separate thread can trigger the I915_GEM_CONTEXT_DESTROY ioctl. > > So we need to ensur

Re: [PATCH] drm/i915: Fix potential context UAFs

2023-01-04 Thread Tvrtko Ursulin
On 03/01/2023 23:49, Rob Clark wrote: From: Rob Clark gem_context_register() makes the context visible to userspace, and which point a separate thread can trigger the I915_GEM_CONTEXT_DESTROY ioctl. So we need to ensure that nothing uses the ctx ptr after this. And we need to ensure that add

[PATCH] drm/i915: Fix potential context UAFs

2023-01-03 Thread Rob Clark
From: Rob Clark gem_context_register() makes the context visible to userspace, and which point a separate thread can trigger the I915_GEM_CONTEXT_DESTROY ioctl. So we need to ensure that nothing uses the ctx ptr after this. And we need to ensure that adding the ctx to the xarray is the *last* th