drm/scheduler: Fix UAF race in drm_sched_entity_push_job()
authorAsahi Lina <lina@asahilina.net>
Wed, 5 Apr 2023 16:37:39 +0000 (01:37 +0900)
committerLuben Tuikov <luben.tuikov@amd.com>
Thu, 6 Apr 2023 21:30:16 +0000 (17:30 -0400)
commit1e1d3574e69f70b848f9d50eca2c5ff04931b7ba
tree87ca3719a977c22a0bf243052bb17b71624b5ada
parent0ec8671837a61d841462179686c5819d951d3b10
drm/scheduler: Fix UAF race in drm_sched_entity_push_job()

After a job is pushed into the queue, it is owned by the scheduler core
and may be freed at any time, so we can't write nor read the submit
timestamp after that point.

Fixes oopses observed with the drm/asahi driver, found with kASAN.

Signed-off-by: Asahi Lina <lina@asahilina.net>
Link: https://lore.kernel.org/r/20230406-scheduler-uaf-2-v1-1-972531cf0a81@asahilina.net
Reviewed-by: Luben Tuikov <luben.tuikov@amd.com>
Signed-off-by: Luben Tuikov <luben.tuikov@amd.com>
drivers/gpu/drm/scheduler/sched_entity.c