Linux kernel (drivers/gpu/drm/xe): The preempt-fence lock lives inside the exec queue, but the queue reference is

Impact

The preempt-fence lock lives inside the exec queue, but the queue reference is dropped as soon as the fence is signalled. A waiter woken afterwards takes a lock inside already-freed memory - a use-after-free of driver state driven by ordinary long-running-queue and VM-bind traffic, and a foothold for kernel memory corruption from a tenant container.

Who can reach it

Tenant holding /dev/dri/renderD* on Intel xe using long-running exec queues or VM binds (i.e. any compute workload): race queue teardown against a thread waiting on the preempt fence. Multiple independent reproducers are referenced in the upstream fix.

What to do

Update to a kernel carrying the fix (stable commits below; no fixed_in published). No selective interim control - preempt fences are on the normal LR/compute submission path.

References