From: Greg Kroah-Hartman Date: Mon, 26 Aug 2024 13:23:17 +0000 (+0200) Subject: 6.10-stable patches X-Git-Tag: v6.1.107~34 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d32291d111de2d45317d42074f7c86b18bd633f5;p=thirdparty%2Fkernel%2Fstable-queue.git 6.10-stable patches added patches: drm-xe-do-not-dereference-null-job-fence-in-trace-points.patch --- diff --git a/queue-6.10/drm-xe-do-not-dereference-null-job-fence-in-trace-points.patch b/queue-6.10/drm-xe-do-not-dereference-null-job-fence-in-trace-points.patch new file mode 100644 index 00000000000..6464c58a732 --- /dev/null +++ b/queue-6.10/drm-xe-do-not-dereference-null-job-fence-in-trace-points.patch @@ -0,0 +1,50 @@ +From 5d30de4311d2d4165e78dc021c5cacb7496b3491 Mon Sep 17 00:00:00 2001 +From: Matthew Brost +Date: Tue, 4 Jun 2024 22:50:41 -0700 +Subject: drm/xe: Do not dereference NULL job->fence in trace points +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Matthew Brost + +commit 5d30de4311d2d4165e78dc021c5cacb7496b3491 upstream. + +job->fence is not assigned until xe_sched_job_arm(), check for +job->fence in xe_sched_job_seqno() so any usage of this function (trace +points) do not result in NULL ptr dereference. Also check job->fence +before assigning error in job trace points. + +Fixes: 0ac7a2c745e8 ("drm/xe: Don't initialize fences at xe_sched_job_create()") +Cc: Thomas Hellström +Signed-off-by: Matthew Brost +Reviewed-by: Lucas De Marchi +Link: https://patchwork.freedesktop.org/patch/msgid/20240605055041.2082074-1-matthew.brost@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/xe_sched_job.h | 2 +- + drivers/gpu/drm/xe/xe_trace.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/xe/xe_sched_job.h ++++ b/drivers/gpu/drm/xe/xe_sched_job.h +@@ -70,7 +70,7 @@ to_xe_sched_job(struct drm_sched_job *dr + + static inline u32 xe_sched_job_seqno(struct xe_sched_job *job) + { +- return job->fence->seqno; ++ return job->fence ? job->fence->seqno : 0; + } + + static inline u32 xe_sched_job_lrc_seqno(struct xe_sched_job *job) +--- a/drivers/gpu/drm/xe/xe_trace.h ++++ b/drivers/gpu/drm/xe/xe_trace.h +@@ -270,7 +270,7 @@ DECLARE_EVENT_CLASS(xe_sched_job, + __entry->guc_state = + atomic_read(&job->q->guc->state); + __entry->flags = job->q->flags; +- __entry->error = job->fence->error; ++ __entry->error = job->fence ? job->fence->error : 0; + __entry->fence = job->fence; + __entry->batch_addr = (u64)job->ptrs[0].batch_addr; + ), diff --git a/queue-6.10/series b/queue-6.10/series index f103e65632f..68787b1fc13 100644 --- a/queue-6.10/series +++ b/queue-6.10/series @@ -264,3 +264,4 @@ mptcp-pm-fullmesh-select-the-right-id-later.patch mptcp-pm-avoid-possible-uaf-when-selecting-endp.patch selftests-mptcp-join-validate-fullmesh-endp-on-1st-sf.patch selftests-mptcp-join-check-re-using-id-of-closed-subflow.patch +drm-xe-do-not-dereference-null-job-fence-in-trace-points.patch