drm/i915/gt: Fix NULL deref on sched_engine alloc failure

Avoid using intel_context_put() before intel_context_init() in
execlists_create_virtual() as the kref_put() inside would lead
to NULL deref on the IOCTL path when sched_engine allocation fails.

Discovered using AI-assisted static analysis confirmed by
Intel Product Security.

Reported-by: Martin Hodo <martin.hodo@intel.com>
Fixes: 3e28d37146db ("drm/i915: Move priolist to new i915_sched_engine object")
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
Cc: Tvrtko Ursulin <tursulin@ursulin.net>
Cc: <stable@vger.kernel.org> # v5.15+
Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
Link: https://lore.kernel.org/r/20260701114513.221254-1-joonas.lahtinen@linux.intel.com
(cherry picked from commit 4f2a12f2d50e9f48227656e4dcbd6423506be31d)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>

diff --git a/drivers/gpu/drm/i915/gt/intel_execlists_submission.c b/drivers/gpu/drm/i915/gt/intel_execlists_submission.c
index 1359fc9cb88ef2e4cb9c698952dfdebc76f67c9d..e693b0c9d2a3e2ee0530b0cafbe39621038c0c20 100644 (file)
--- a/drivers/gpu/drm/i915/gt/intel_execlists_submission.c
+++ b/drivers/gpu/drm/i915/gt/intel_execlists_submission.c
@@ -3932,11 +3932,11 @@ execlists_create_virtual(struct intel_engine_cs **siblings, unsigned int count,
        struct drm_i915_private *i915 = siblings[0]->i915;
        struct virtual_engine *ve;
        unsigned int n;
-       int err;
+       int err = -ENOMEM;
 
        ve = kzalloc_flex(*ve, siblings, count);
        if (!ve)
-               return ERR_PTR(-ENOMEM);
+               goto err;
 
        ve->base.i915 = i915;
        ve->base.gt = siblings[0]->gt;
@@ -3968,10 +3968,8 @@ execlists_create_virtual(struct intel_engine_cs **siblings, unsigned int count,
        intel_engine_init_execlists(&ve->base);
 
        ve->base.sched_engine = i915_sched_engine_create(ENGINE_VIRTUAL);
-       if (!ve->base.sched_engine) {
-               err = -ENOMEM;
-               goto err_put;
-       }
+       if (!ve->base.sched_engine)
+               goto err_noput;
        ve->base.sched_engine->private_data = &ve->base;
 
        ve->base.cops = &virtual_context_ops;
@@ -3987,10 +3985,8 @@ execlists_create_virtual(struct intel_engine_cs **siblings, unsigned int count,
        intel_context_init(&ve->context, &ve->base);
 
        ve->base.breadcrumbs = intel_breadcrumbs_create(NULL);
-       if (!ve->base.breadcrumbs) {
-               err = -ENOMEM;
+       if (!ve->base.breadcrumbs)
                goto err_put;
-       }
 
        for (n = 0; n < count; n++) {
                struct intel_engine_cs *sibling = siblings[n];
@@ -4065,8 +4061,13 @@ execlists_create_virtual(struct intel_engine_cs **siblings, unsigned int count,
        virtual_engine_initial_hint(ve);
        return &ve->context;
 
+err_noput:
+       kfree(ve);
+       goto err;
+
 err_put:
        intel_context_put(&ve->context);
+err:
        return ERR_PTR(err);
 }