drm/i915: Avoid potential vm use-after-free

From Rob Clark
764accc2c1b8fd1507be2e7f436c94cdce887a00 in linux-6.1.y/6.1.11
41d419382ec7e257e54b7b6ff0d3623aafb1316d in mainline linux

diff --git a/sys/dev/pci/drm/i915/gem/i915_gem_context.c b/sys/dev/pci/drm/i915/gem/i915_gem_context.c
index 2a49ede..9271130 100644 (file)
--- a/sys/dev/pci/drm/i915/gem/i915_gem_context.c
+++ b/sys/dev/pci/drm/i915/gem/i915_gem_context.c
@@ -1890,11 +1890,19 @@ static int get_ppgtt(struct drm_i915_file_private *file_priv,
        vm = ctx->vm;
        GEM_BUG_ON(!vm);
 
+       /*
+        * Get a reference for the allocated handle.  Once the handle is
+        * visible in the vm_xa table, userspace could try to close it
+        * from under our feet, so we need to hold the extra reference
+        * first.
+        */
+       i915_vm_get(vm);
+
        err = xa_alloc(&file_priv->vm_xa, &id, vm, xa_limit_32b, GFP_KERNEL);
-       if (err)
+       if (err) {
+               i915_vm_put(vm);
                return err;
-
-       i915_vm_get(vm);
+       }
 
        GEM_BUG_ON(id == 0); /* reserved for invalid/unassigned ppgtt */
        args->value = id;