mirrors/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-04-30 17:00:08 -04:00
Code Issues Packages Projects Releases Wiki Activity

drm/xe: Protect devcoredump access after unbind

Browse Source 
While we don't have the full flow protection when devcoredump
is accessed after device unbind. Let's at least for now
protect against null dereference:

[  422.766508] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
[  423.119584] RIP: 0010:xe_vm_snapshot_free+0x30/0x180 [xe]

While at it, I also fixed a non-standard code-declaration block
on the similar function of xe_guc_submit.

v2: - Use IS_ERR_OR_NULL (Nirmoy)
    - Expand to other functions

Cc: José Roberto de Souza <jose.souza@intel.com>
Cc: Nirmoy Das <nirmoy.das@intel.com>
Reviewed-by: Nirmoy Das <nirmoy.das@intel.com>
Reviewed-by: José Roberto de Souza <jose.souza@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240403195044.239766-1-rodrigo.vivi@intel.com
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
This commit is contained in:
Rodrigo Vivi
2024-04-03 15:50:44 -04:00
parent 34820967ae
commit 972d01d0e3
2 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
drivers/gpu/drm/xe/xe_guc_submit.c
View File

@@ -1928,6 +1928,7 @@ xe_guc_exec_queue_snapshot_print(struct xe_guc_submit_exec_queue_snapshot *snaps
void xe_guc_exec_queue_snapshot_free(struct xe_guc_submit_exec_queue_snapshot *snapshot)
{
int i;
if (!snapshot)
return;

6
drivers/gpu/drm/xe/xe_vm.c
View File

@@ -3426,7 +3426,7 @@ struct xe_vm_snapshot *xe_vm_snapshot_capture(struct xe_vm *vm)
void xe_vm_snapshot_capture_delayed(struct xe_vm_snapshot *snap)
{
if (IS_ERR(snap))
if (IS_ERR_OR_NULL(snap))
return;
for (int i = 0; i < snap->num_snaps; i++) {
@@ -3483,7 +3483,7 @@ void xe_vm_snapshot_print(struct xe_vm_snapshot *snap, struct drm_printer *p)
{
unsigned long i, j;
if (IS_ERR(snap)) {
if (IS_ERR_OR_NULL(snap)) {
drm_printf(p, "[0].error: %li\n", PTR_ERR(snap));
return;
}
@@ -3514,7 +3514,7 @@ void xe_vm_snapshot_free(struct xe_vm_snapshot *snap)
{
unsigned long i;
if (IS_ERR(snap))
if (IS_ERR_OR_NULL(snap))
return;
for (i = 0; i < snap->num_snaps; i++) {