]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
drm/xe: Fix potential NULL deref in xe_exec_queue_tlb_inval_last_fence_put_unlocked
authorShuicheng Lin <shuicheng.lin@intel.com>
Thu, 9 Apr 2026 00:34:49 +0000 (00:34 +0000)
committerShuicheng Lin <shuicheng.lin@intel.com>
Tue, 14 Apr 2026 15:32:40 +0000 (08:32 -0700)
commit96078a1c68bf97f17fd1d08c3f58f5c5cc9ccd65
tree13117a365812e8a8fab1206f19be4b864db899f5
parent3e3fbb5ee3092015db2dc9843a605896b2cca97b
drm/xe: Fix potential NULL deref in xe_exec_queue_tlb_inval_last_fence_put_unlocked

xe_exec_queue_tlb_inval_last_fence_put_unlocked() uses q->vm->xe as the
first argument to xe_assert(). This function is called unconditionally
from xe_exec_queue_destroy() for all queues, including kernel queues
that have q->vm == NULL (e.g., queues created during GT init in
xe_gt_record_default_lrcs() with vm=NULL).

While current compilers optimize away the q->vm->xe dereference (even
in CONFIG_DRM_XE_DEBUG=y builds, the compiler pushes the dereference
into the WARN branch that is only taken when the assert condition is
false), the code is semantically incorrect and constitutes undefined
behavior in the C abstract machine for the NULL pointer case.

Use gt_to_xe(q->gt) instead, which is always valid for any exec queue.
This is consistent with how xe_exec_queue_destroy() itself obtains the
xe_device pointer in its own xe_assert at the top of the function.

Fixes: b2d7ec41f2a3 ("drm/xe: Attach last fence to TLB invalidation job queues")
Assisted-by: Claude:claude-opus-4.6
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://patch.msgid.link/20260409003449.3405767-1-shuicheng.lin@intel.com
Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
drivers/gpu/drm/xe/xe_exec_queue.c