6.10-stable patches

added patches:
	drm-xe-do-not-dereference-null-job-fence-in-trace-points.patch

diff --git a/queue-6.10/drm-xe-do-not-dereference-null-job-fence-in-trace-points.patch b/queue-6.10/drm-xe-do-not-dereference-null-job-fence-in-trace-points.patch
new file mode 100644 (file)
index 0000000..6464c58
--- /dev/null
+++ b/queue-6.10/drm-xe-do-not-dereference-null-job-fence-in-trace-points.patch
@@ -0,0 +1,50 @@
+From 5d30de4311d2d4165e78dc021c5cacb7496b3491 Mon Sep 17 00:00:00 2001
+From: Matthew Brost <matthew.brost@intel.com>
+Date: Tue, 4 Jun 2024 22:50:41 -0700
+Subject: drm/xe: Do not dereference NULL job->fence in trace points
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Matthew Brost <matthew.brost@intel.com>
+
+commit 5d30de4311d2d4165e78dc021c5cacb7496b3491 upstream.
+
+job->fence is not assigned until xe_sched_job_arm(), check for
+job->fence in xe_sched_job_seqno() so any usage of this function (trace
+points) do not result in NULL ptr dereference. Also check job->fence
+before assigning error in job trace points.
+
+Fixes: 0ac7a2c745e8 ("drm/xe: Don't initialize fences at xe_sched_job_create()")
+Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240605055041.2082074-1-matthew.brost@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/xe/xe_sched_job.h |    2 +-
+ drivers/gpu/drm/xe/xe_trace.h     |    2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/xe/xe_sched_job.h
++++ b/drivers/gpu/drm/xe/xe_sched_job.h
+@@ -70,7 +70,7 @@ to_xe_sched_job(struct drm_sched_job *dr
+ 
+ static inline u32 xe_sched_job_seqno(struct xe_sched_job *job)
+ {
+-      return job->fence->seqno;
++      return job->fence ? job->fence->seqno : 0;
+ }
+ 
+ static inline u32 xe_sched_job_lrc_seqno(struct xe_sched_job *job)
+--- a/drivers/gpu/drm/xe/xe_trace.h
++++ b/drivers/gpu/drm/xe/xe_trace.h
+@@ -270,7 +270,7 @@ DECLARE_EVENT_CLASS(xe_sched_job,
+                          __entry->guc_state =
+                          atomic_read(&job->q->guc->state);
+                          __entry->flags = job->q->flags;
+-                         __entry->error = job->fence->error;
++                         __entry->error = job->fence ? job->fence->error : 0;
+                          __entry->fence = job->fence;
+                          __entry->batch_addr = (u64)job->ptrs[0].batch_addr;
+                          ),

diff --git a/queue-6.10/series b/queue-6.10/series
index f103e65632fc80c1fa831c0476a2d561b5b2202f..68787b1fc13a6df1620bc9bf067800d89c56bd91 100644 (file)
--- a/queue-6.10/series
+++ b/queue-6.10/series
@@ -264,3 +264,4 @@ mptcp-pm-fullmesh-select-the-right-id-later.patch
 mptcp-pm-avoid-possible-uaf-when-selecting-endp.patch
 selftests-mptcp-join-validate-fullmesh-endp-on-1st-sf.patch
 selftests-mptcp-join-check-re-using-id-of-closed-subflow.patch
+drm-xe-do-not-dereference-null-job-fence-in-trace-points.patch