drm/i915/gt: Fix potential UAF by revoke of fence registers

From Janusz Krzysztofik
06dec31a0a5112a91f49085e8a8fa1a82296d5c7 in linux-6.6.y/6.6.37
996c3412a06578e9d779a16b9e79ace18125ab50 in mainline linux

diff --git a/sys/dev/pci/drm/i915/gt/intel_ggtt_fencing.c b/sys/dev/pci/drm/i915/gt/intel_ggtt_fencing.c
index 2972719..bbb3987 100644 (file)
--- a/sys/dev/pci/drm/i915/gt/intel_ggtt_fencing.c
+++ b/sys/dev/pci/drm/i915/gt/intel_ggtt_fencing.c
@@ -298,6 +298,7 @@ void i915_vma_revoke_fence(struct i915_vma *vma)
                return;
 
        GEM_BUG_ON(fence->vma != vma);
+       i915_active_wait(&fence->active);
        GEM_BUG_ON(!i915_active_is_idle(&fence->active));
        GEM_BUG_ON(atomic_read(&fence->pin_count));