In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/xe\/guc: Hold device ref until queue teardown completes<\/p>\n
GuC exec queue destruction can run asynchronously. If the final device
\nput happens from a destroy worker, drmm cleanup can end up draining
\nthe same workqueue and deadlock.<\/p>\n
Hold a drm_device reference for the queue lifetime and drop it after
\nqueue teardown completes. This keeps drmm cleanup from running while
\nasync destroy work is still pending.<\/p>\n
Move GuC destroy work to a module-lifetime Xe workqueue and flush it
\non PCI remove so hot-unbind\/rebind still waits for pending destroy work.<\/p>\n
With queue-held device refs, guc_submit_sw_fini() cannot run with live
\nGuC IDs. Replace the fini wait with an assertion and remove the unused
\nfini_wq.<\/p>\n
v2:
\n – Rebase<\/p>\n
v3:
\n – Switch to queue-lifetime drm_dev_get()\/drm_dev_put() model. (Matt)
\n – Queue async teardown on system_dfl_wq instead of xe->destroy_wq. (Matt)
\n – Drop separate deferred drm_dev_put worker.
\n – Remove stale drain_workqueue(xe->destroy_wq) from guc_submit_sw_fini().<\/p>\n
v4:
\n – Replace the guc_submit_sw_fini() wait with an assertion and remove
\n the now-unused fini_wq. (sashiko)<\/p>\n
v5:
\n – Move destroy work to a module-lifetime Xe workqueue instead of
\n system_dfl_wq. (Matt)
\n – Flush the module-lifetime destroy workqueue during PCI remove to
\n preserve the old device-remove wait semantics.<\/p>\n
v6:
\n – Keep SVM pagemap destroy work on the per-device destroy_wq to avoid
\n letting it outlive the xe_device\/drm_device. (Sashiko)
\n – Use WQ_MEM_RECLAIM for xe->destroy_wq because SVM pagemap destroy work
\n can be queued from the reclaim path.<\/p>\n
v7:
\n – Drop the per-device xe->destroy_wq and use the module-level destroy WQ
\n for SVM pagemap destroy as well. (Matt)
\n – Rename xe_exec_queue_destroy_wq_*() helpers to xe_destroy_wq_*()
\n helpers because the WQ is no longer exec-queue specific. (Matt)<\/p>\n
v8:
\n – Rebase.<\/p>\n
v9:
\n – Keep SVM pagemap destroy work on the per-device WQ_MEM_RECLAIM
\n destroy_wq because it can be queued from reclaim and embeds
\n the dev_pagemap used by devres teardown. (Sashiko)
\n – Keep the module-level destroy WQ GuC-only and drop WQ_MEM_RECLAIM
\n from it.
\n – Update the module-WQ kdoc to document the GuC\/SVM split.<\/p>\n
v10:
\n – Keep xe->destroy_wq per-cpu while adding WQ_MEM_RECLAIM to fix the
\n workqueue allocation warning.<\/p>\n
v11:
\n – Drop the SVM pagemap destroy comment as it was revision-specific.
\n (Thomas)<\/p>\n
v12:
\n – Rebase.<\/p>\n
(cherry picked from commit da1124abac689cc2b1d8995e5f0a816f8a122edb)<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/xe\/guc: Hold device ref until queue teardown completes<\/p>\n
GuC exec queue destruction can run asynchronously. If the final device<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5447","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5447","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5447"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5447"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5447"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}