diff options
| author | Dave Airlie <airlied@redhat.com> | 2025-11-28 06:46:35 +1000 |
|---|---|---|
| committer | Dave Airlie <airlied@redhat.com> | 2025-11-28 06:46:44 +1000 |
| commit | 578d6aab14899ef782e1605b31707219ee710048 (patch) | |
| tree | 177b72268c14c4270d23856eb4137eb6c849d265 | |
| parent | 611d4d160616a8f96959a3045ed01bc9afe0900f (diff) | |
| parent | dcb171931954c51a1a7250d558f02b8f36570783 (diff) | |
Merge tag 'drm-xe-next-fixes-2025-11-21' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next
Driver Changes:
- A couple of SR-IOV fixes (Michal Winiarski)
- Fix a potential UAF (Sanjay)
Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Thomas Hellstrom <thomas.hellstrom@linux.intel.com>
Link: https://patch.msgid.link/aSA08EW9JMU3LkIu@fedora
| -rw-r--r-- | drivers/gpu/drm/xe/xe_gt_sriov_pf_migration.c | 11 | ||||
| -rw-r--r-- | drivers/gpu/drm/xe/xe_oa.c | 8 | ||||
| -rw-r--r-- | drivers/gpu/drm/xe/xe_sriov_pf_migration.c | 2 |
3 files changed, 16 insertions, 5 deletions
diff --git a/drivers/gpu/drm/xe/xe_gt_sriov_pf_migration.c b/drivers/gpu/drm/xe/xe_gt_sriov_pf_migration.c index 35a12d48dcc1..d5d918ddce4f 100644 --- a/drivers/gpu/drm/xe/xe_gt_sriov_pf_migration.c +++ b/drivers/gpu/drm/xe/xe_gt_sriov_pf_migration.c @@ -571,6 +571,10 @@ static int pf_save_vram_chunk(struct xe_gt *gt, unsigned int vfid, fence = __pf_save_restore_vram(gt, vfid, src_vram, src_vram_offset, data->bo, 0, size, true); + if (IS_ERR(fence)) { + ret = PTR_ERR(fence); + goto fail; + } ret = dma_fence_wait_timeout(fence, false, PF_VRAM_SAVE_RESTORE_TIMEOUT); dma_fence_put(fence); @@ -654,6 +658,11 @@ static int pf_restore_vf_vram_mig_data(struct xe_gt *gt, unsigned int vfid, fence = __pf_save_restore_vram(gt, vfid, vram, data->hdr.offset, data->bo, 0, data->hdr.size, false); + if (IS_ERR(fence)) { + ret = PTR_ERR(fence); + goto err; + } + ret = dma_fence_wait_timeout(fence, false, PF_VRAM_SAVE_RESTORE_TIMEOUT); dma_fence_put(fence); if (!ret) { @@ -661,6 +670,8 @@ static int pf_restore_vf_vram_mig_data(struct xe_gt *gt, unsigned int vfid, goto err; } + xe_bo_put(vram); + return 0; err: xe_bo_put(vram); diff --git a/drivers/gpu/drm/xe/xe_oa.c b/drivers/gpu/drm/xe/xe_oa.c index 87a2bf53d661..890c363282ae 100644 --- a/drivers/gpu/drm/xe/xe_oa.c +++ b/drivers/gpu/drm/xe/xe_oa.c @@ -2403,11 +2403,13 @@ int xe_oa_add_config_ioctl(struct drm_device *dev, u64 data, struct drm_file *fi goto sysfs_err; } - mutex_unlock(&oa->metrics_lock); + id = oa_config->id; + + drm_dbg(&oa->xe->drm, "Added config %s id=%i\n", oa_config->uuid, id); - drm_dbg(&oa->xe->drm, "Added config %s id=%i\n", oa_config->uuid, oa_config->id); + mutex_unlock(&oa->metrics_lock); - return oa_config->id; + return id; sysfs_err: mutex_unlock(&oa->metrics_lock); diff --git a/drivers/gpu/drm/xe/xe_sriov_pf_migration.c b/drivers/gpu/drm/xe/xe_sriov_pf_migration.c index 21b06ce6830a..de06cc690fc8 100644 --- a/drivers/gpu/drm/xe/xe_sriov_pf_migration.c +++ b/drivers/gpu/drm/xe/xe_sriov_pf_migration.c @@ -148,8 +148,6 @@ pf_migration_consume(struct xe_device *xe, unsigned int vfid) * Return: Pointer to &xe_sriov_packet on success, * NULL if ring is empty and no more migration data is expected, * ERR_PTR value in case of error. - * - * Return: 0 on success or a negative error code on failure. */ struct xe_sriov_packet * xe_sriov_pf_migration_save_consume(struct xe_device *xe, unsigned int vfid) |