Skip to content

[UR][L0] Guard against use after free for barrier events #18164

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Apr 24, 2025
Merged

[UR][L0] Guard against use after free for barrier events #18164

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 10 additions & 5 deletions unified-runtime/source/adapters/level_zero/event.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -890,13 +890,14 @@ urEventRelease(/** [in] handle of the event object */ ur_event_handle_t Event) {
(Event->CommandType == UR_COMMAND_EVENTS_WAIT ||
Event->CommandType == UR_COMMAND_EVENTS_WAIT_WITH_BARRIER) &&
Event->Completed;
UR_CALL(urEventReleaseInternal(Event));
bool isEventDeleted = false;
UR_CALL(urEventReleaseInternal(Event, &isEventDeleted));
// If this is a Completed Event Wait Out Event, then we need to cleanup the
// event at user release and not at the time of completion.
// If the event is labelled as completed and no additional references are
// removed, then we still need to decrement the event, but not mark as
// completed.
if (isEventsWaitCompleted) {
if (isEventsWaitCompleted & !isEventDeleted) {
if (Event->CleanedUp) {
UR_CALL(urEventReleaseInternal(Event));
} else {
Expand Down Expand Up @@ -1087,12 +1088,13 @@ ur_event_handle_t_::~ur_event_handle_t_() {
}
}

ur_result_t urEventReleaseInternal(ur_event_handle_t Event) {
ur_result_t urEventReleaseInternal(ur_event_handle_t Event,
bool *isEventDeleted) {
if (!Event->RefCount.decrementAndTest())
return UR_RESULT_SUCCESS;

if (Event->OriginAllocEvent) {
urEventReleaseInternal(Event->OriginAllocEvent);
urEventReleaseInternal(Event->OriginAllocEvent, isEventDeleted);
}

if (Event->CommandType == UR_COMMAND_MEM_UNMAP && Event->CommandData) {
Expand Down Expand Up @@ -1133,7 +1135,7 @@ ur_result_t urEventReleaseInternal(ur_event_handle_t Event) {
// and release a reference to it.
if (Event->HostVisibleEvent && Event->HostVisibleEvent != Event) {
// Decrement ref-count of the host-visible proxy event.
UR_CALL(urEventReleaseInternal(Event->HostVisibleEvent));
UR_CALL(urEventReleaseInternal(Event->HostVisibleEvent, isEventDeleted));
}

// Save pointer to the queue before deleting/resetting event.
Expand Down Expand Up @@ -1162,6 +1164,9 @@ ur_result_t urEventReleaseInternal(ur_event_handle_t Event) {
// must released later.
if (DisableEventsCaching || !Event->OwnNativeHandle) {
delete Event;
if (isEventDeleted) {
*isEventDeleted = true;
}
} else {
Event->Context->addEventToContextCache(Event);
}
Expand Down
3 changes: 2 additions & 1 deletion unified-runtime/source/adapters/level_zero/event.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,8 @@
#include "ur_api.h"

extern "C" {
ur_result_t urEventReleaseInternal(ur_event_handle_t Event);
ur_result_t urEventReleaseInternal(ur_event_handle_t Event,
bool *isEventDeleted = nullptr);
ur_result_t EventCreate(ur_context_handle_t Context, ur_queue_handle_t Queue,
bool IsMultiDevice, bool HostVisible,
ur_event_handle_t *RetEvent,
Expand Down