Files
linux/drivers/gpu/drm/xe
Christoph Manszewski 111fb43a55 drm/xe: Fix vm_bind_ioctl double free bug
If the argument check during an array bind fails, the bind_ops are freed
twice as seen below. Fix this by setting bind_ops to NULL after freeing.

==================================================================
BUG: KASAN: double-free in xe_vm_bind_ioctl+0x1b2/0x21f0 [xe]
Free of addr ffff88813bb9b800 by task xe_vm/14198

CPU: 5 UID: 0 PID: 14198 Comm: xe_vm Not tainted 6.16.0-xe-eudebug-cmanszew+ #520 PREEMPT(full)
Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR5 RVP, BIOS ADLPFWI1.R00.2411.A02.2110081023 10/08/2021
Call Trace:
 <TASK>
 dump_stack_lvl+0x82/0xd0
 print_report+0xcb/0x610
 ? __virt_addr_valid+0x19a/0x300
 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe]
 kasan_report_invalid_free+0xc8/0xf0
 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe]
 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe]
 check_slab_allocation+0x102/0x130
 kfree+0x10d/0x440
 ? should_fail_ex+0x57/0x2f0
 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe]
 xe_vm_bind_ioctl+0x1b2/0x21f0 [xe]
 ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe]
 ? __lock_acquire+0xab9/0x27f0
 ? lock_acquire+0x165/0x300
 ? drm_dev_enter+0x53/0xe0 [drm]
 ? find_held_lock+0x2b/0x80
 ? drm_dev_exit+0x30/0x50 [drm]
 ? drm_ioctl_kernel+0x128/0x1c0 [drm]
 drm_ioctl_kernel+0x128/0x1c0 [drm]
 ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe]
 ? find_held_lock+0x2b/0x80
 ? __pfx_drm_ioctl_kernel+0x10/0x10 [drm]
 ? should_fail_ex+0x57/0x2f0
 ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe]
 drm_ioctl+0x352/0x620 [drm]
 ? __pfx_drm_ioctl+0x10/0x10 [drm]
 ? __pfx_rpm_resume+0x10/0x10
 ? do_raw_spin_lock+0x11a/0x1b0
 ? find_held_lock+0x2b/0x80
 ? __pm_runtime_resume+0x61/0xc0
 ? rcu_is_watching+0x20/0x50
 ? trace_irq_enable.constprop.0+0xac/0xe0
 xe_drm_ioctl+0x91/0xc0 [xe]
 __x64_sys_ioctl+0xb2/0x100
 ? rcu_is_watching+0x20/0x50
 do_syscall_64+0x68/0x2e0
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7fa9acb24ded

Fixes: b43e864af0 ("drm/xe/uapi: Add DRM_XE_VM_BIND_FLAG_CPU_ADDR_MIRROR")
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Signed-off-by: Christoph Manszewski <christoph.manszewski@intel.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Signed-off-by: Matthew Brost <matthew.brost@intel.com>
Link: https://lore.kernel.org/r/20250813101231.196632-2-christoph.manszewski@intel.com
(cherry picked from commit a01b704527)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2025-08-21 15:06:58 -04:00
..
2025-08-14 10:30:53 -04:00
2024-05-09 21:28:25 +02:00
2025-07-14 13:20:02 -07:00
2025-01-09 17:58:09 +01:00
2025-06-27 14:52:31 -07:00
2025-07-14 07:55:18 -07:00
2025-07-14 07:55:18 -07:00
2025-06-02 11:00:46 -07:00
2025-06-27 14:52:31 -07:00
2025-07-01 13:58:50 -07:00
2025-06-27 14:52:31 -07:00
2025-06-27 14:52:31 -07:00
2025-03-25 20:51:29 -07:00
2025-01-14 07:02:49 -08:00
2024-11-15 15:59:51 -08:00
2024-05-13 21:36:50 +02:00
2025-06-27 14:52:31 -07:00
2025-07-01 13:55:19 -07:00
2025-07-01 13:55:19 -07:00
2025-06-27 14:52:31 -07:00
2024-05-22 12:03:55 +02:00
2025-07-14 13:40:17 -07:00
2024-09-19 10:15:40 +02:00
2024-05-07 12:03:49 +02:00
2025-08-14 10:30:53 -04:00
2025-01-27 08:54:06 -08:00
2025-02-03 11:51:26 -08:00
2024-05-13 21:36:52 +02:00
2025-07-14 07:55:18 -07:00
2025-07-14 07:55:18 -07:00
2025-01-19 00:12:02 +01:00
2025-06-27 14:52:31 -07:00
2025-07-28 10:22:28 -04:00
2025-01-17 00:01:58 +05:30
2025-04-10 15:50:01 -07:00