drm/xe: Free job before xe_exec_queue_put

[ Upstream commit 9e7f30563677fbeff62d368d5d2a5ac7aaa9746a ]

Free job depends on job->vm being valid, the last xe_exec_queue_put can
destroy the VM. Prevent UAF by freeing job before xe_exec_queue_put.

Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Signed-off-by: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: Nirmoy Das <nirmoy.das@intel.com>
Reviewed-by: Jagmeet Randhawa <jagmeet.randhawa@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240820202309.1260755-1-matthew.brost@intel.com
(cherry picked from commit 32a42c93b74c8ca6d0915ea3eba21bceff53042f)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/gpu/drm/xe/xe_sched_job.c b/drivers/gpu/drm/xe/xe_sched_job.c
index 29f3201d7dfacef22fc4e72ac243dc7ddc71b52c..2b064680abb96519f688db57ffff75f9da230b06 100644 (file)
--- a/drivers/gpu/drm/xe/xe_sched_job.c
+++ b/drivers/gpu/drm/xe/xe_sched_job.c
@@ -171,12 +171,13 @@ void xe_sched_job_destroy(struct kref *ref)
        struct xe_sched_job *job =
                container_of(ref, struct xe_sched_job, refcount);
        struct xe_device *xe = job_to_xe(job);
+       struct xe_exec_queue *q = job->q;
 
        xe_sched_job_free_fences(job);
-       xe_exec_queue_put(job->q);
        dma_fence_put(job->fence);
        drm_sched_job_cleanup(&job->drm);
        job_free(job);
+       xe_exec_queue_put(q);
        xe_pm_runtime_put(xe);
 }