From: jsg <jsg@openbsd.org>
Date: Mon, 8 Jul 2024 02:15:57 +0000 (+0000)
Subject: drm/i915/gt: Fix potential UAF by revoke of fence registers
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=0623777a7011280fe10094b82420c00c94b1a851;p=openbsd

drm/i915/gt: Fix potential UAF by revoke of fence registers

From Janusz Krzysztofik
06dec31a0a5112a91f49085e8a8fa1a82296d5c7 in linux-6.6.y/6.6.37
996c3412a06578e9d779a16b9e79ace18125ab50 in mainline linux
---

diff --git a/sys/dev/pci/drm/i915/gt/intel_ggtt_fencing.c b/sys/dev/pci/drm/i915/gt/intel_ggtt_fencing.c
index 29727199a34..bbb3987f068 100644
--- a/sys/dev/pci/drm/i915/gt/intel_ggtt_fencing.c
+++ b/sys/dev/pci/drm/i915/gt/intel_ggtt_fencing.c
@@ -298,6 +298,7 @@ void i915_vma_revoke_fence(struct i915_vma *vma)
 		return;
 
 	GEM_BUG_ON(fence->vma != vma);
+	i915_active_wait(&fence->active);
 	GEM_BUG_ON(!i915_active_is_idle(&fence->active));
 	GEM_BUG_ON(atomic_read(&fence->pin_count));