diff options
| author |   Harish Chegondi <harish.chegondi@intel.com> | 2025-03-12 10:31:20 -0700 |
|---|---|---|
| committer |   Lucas De Marchi <lucas.demarchi@intel.com> | 2025-03-20 13:01:07 -0700 |
| commit | 488975c2d3e171bd07ec5caaf3c9cbc6a0746e2d (patch) | |
| tree | 8129f59f29ba5378b80350168261a63fcc688733 | |
| parent | Merge tag 'drm-xe-next-fixes-2025-03-12' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next (diff) | |
| download | wireguard-linux-488975c2d3e171bd07ec5caaf3c9cbc6a0746e2d.tar.xz wireguard-linux-488975c2d3e171bd07ec5caaf3c9cbc6a0746e2d.zip | |
drm/xe/eustall: Fix a possible pointer dereference after free
If devm_add_action_or_reset() isn't successful, xe_eu_stall_fini()
is invoked. So, unsuccessful return from devm_add_action_or_reset()
shouldn't dereference gt->eu_stall as xe_eu_stall_fini() already
frees it. Fix this issue.
Fixes: 9a0b11d4cf3b ("drm/xe/eustall: Add support to init, enable and disable EU stall sampling")
Signed-off-by: Harish Chegondi <harish.chegondi@intel.com>
Reviewed-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
Signed-off-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/eae49a414a7314921108e0388810aaee6261ad92.1741800396.git.harish.chegondi@intel.com
(cherry picked from commit 278469ff569e1082d56b4a7af26fbaecef9fbf3b)
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
Diffstat (limited to '')
| -rw-r--r-- | drivers/gpu/drm/xe/xe_eu_stall.c | 8 |
1 files changed, 1 insertions, 7 deletions
diff --git a/drivers/gpu/drm/xe/xe_eu_stall.c b/drivers/gpu/drm/xe/xe_eu_stall.c index 88a92baf5c95..f2bb9168967c 100644 --- a/drivers/gpu/drm/xe/xe_eu_stall.c +++ b/drivers/gpu/drm/xe/xe_eu_stall.c @@ -222,13 +222,7 @@ int xe_eu_stall_init(struct xe_gt *gt) goto exit_free; } - ret = devm_add_action_or_reset(xe->drm.dev, xe_eu_stall_fini, gt); - if (ret) - goto exit_destroy; - - return 0; -exit_destroy: - destroy_workqueue(gt->eu_stall->buf_ptr_poll_wq); + return devm_add_action_or_reset(xe->drm.dev, xe_eu_stall_fini, gt); exit_free: mutex_destroy(>->eu_stall->stream_lock); kfree(gt->eu_stall); |