7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Osama Abdelkader commit 7764289d76a38c3a2f9b093bf17e193ab54acd70 upstream. panthor_group_destroy() checks the GROUP_REGISTERED mark and then calls xa_erase() without holding the xarray lock across both. If the handle is destroyed by another thread in between, and a concurrent GROUP_CREATE reuses the freed ID, the first destroy erases and releases the new, still-initializing group, leading to a use-after-free in panthor_group_create(). Do the mark check and erase atomically under xa_lock(). Fixes: eec7e23d848d ("drm/panthor: Prevent potential UAF in group creation") Assisted-by: Claude:claude-opus-5.5 Reviewed-by: Boris Brezillon Reviewed-by: Liviu Dudau Cc: stable@vger.kernel.org Signed-off-by: Osama Abdelkader Reviewed-by: Steven Price Signed-off-by: Liviu Dudau Link: https://patch.msgid.link/20261008100935.3059587-1-osama.abdelkader@gmail.com Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/panthor/panthor_sched.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) --- a/drivers/gpu/drm/panthor/panthor_sched.c +++ b/drivers/gpu/drm/panthor/panthor_sched.c @@ -3794,12 +3794,18 @@ int panthor_group_destroy(struct panthor struct panthor_group_pool *gpool = pfile->groups; struct panthor_device *ptdev = pfile->ptdev; struct panthor_scheduler *sched = ptdev->scheduler; - struct panthor_group *group; + struct panthor_group *group = NULL; - if (!xa_get_mark(&gpool->xa, group_handle, GROUP_REGISTERED)) - return -EINVAL; + /* + * Check the mark and erase the entry atomically, so a concurrent + * destroy + create can't make us erase a group that's still being + * initialized and happens to reuse the same handle. + */ + xa_lock(&gpool->xa); + if (xa_get_mark(&gpool->xa, group_handle, GROUP_REGISTERED)) + group = __xa_erase(&gpool->xa, group_handle); + xa_unlock(&gpool->xa); - group = xa_erase(&gpool->xa, group_handle); if (!group) return -EINVAL;