Linux kernel (drivers/gpu/drm/xe): Xe freed a job from inside timeout-detection-and-recovery while the submission

Impact

Xe freed a job from inside timeout-detection-and-recovery while the submission thread could still be running it, giving a use-after-free on the job object. The trigger is a GPU hang, and any tenant can cause a GPU hang on demand with a runaway shader - so this converts a self-inflicted hang into kernel memory corruption on a node shared with other tenants.

Who can reach it

An unprivileged container with /dev/dri/renderD* on an Intel Xe node submits a job that never completes; the TDR path then fires and races the run_job thread. Deliberately hanging the GPU is trivial from userspace, which makes this attacker-scheduled rather than incidental.

What to do

Update to a kernel with the fix commits below, which defers the free to the scheduler. Interim: restrict render-node access to trusted workloads and monitor for repeated GPU resets, which are the signal that someone is exercising this path.

References