From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 74E585C613; Thu, 30 Jul 2026 14:40:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785422449; cv=none; b=hzHIPysIVhtAH9vNh5wo1gGjFQFPLBmNTUdbqXwA9bRIJyc5Me3tlivVNAiP4gSBObEAyb2mpPteGL9lFokf2pFRNZ0fVrTyfo7+JqDLLEwFHhQpsx8aulrzcrBWnvVX4BCwmfDw+OdCpVJmEudUAYd68Nzp3cqppzp9xmS+3/g= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785422449; c=relaxed/simple; bh=hohn45oomncffZaM+pRDO+R5KLdKTggBQZ6KPSgPls4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=PAd+Jd2WztT2okV8BwvPwkDkqUksrJDtV+rVNc69GpXW3eJJi0USAChugN0rN5baXr3hQ/n20Dyrtr3g0m0xlUmK0526Lv3+rnzRJHxKiE8u3PRA3/kWx9qu57rD0fPgMPXzT/6vegXkIb+qqZlAt2mECPJtsIPU+lrfZTlatlw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=GoThFsms; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="GoThFsms" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D5DCC1F000E9; Thu, 30 Jul 2026 14:40:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1785422448; bh=aHwcDNMXreggI1ExIahKw7j4RPjTQbTRFqBLYHSYAAg=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=GoThFsmsbBYvYxC37rR6cg/qwljDQVJi41FhYrUZS4huQKSxATqxV1HbdaoDzSQqL HXxG/BDh/Eqlpk6FOEhE8XB+Zy8kKBG7oBQLp3B++rzz6Vw1aiViU2HAN2fsY8XV1X /MPFPWRxtfNbdtpg3XKP+QtIYaPpjlZevbkRdffo= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Martin Hodo , Matthew Brost , Daniele Ceraolo Spurio , Tvrtko Ursulin , Joonas Lahtinen , Andi Shyti , Rodrigo Vivi Subject: [PATCH 7.1 441/744] drm/i915/gt: Fix NULL deref on sched_engine alloc failure Date: Thu, 30 Jul 2026 16:11:54 +0200 Message-ID: <20260730141453.673262052@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260730141444.267951807@linuxfoundation.org> References: <20260730141444.267951807@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joonas Lahtinen commit 82ec992c404c3dc774c5e9f3d4aa858e97187675 upstream. Avoid using intel_context_put() before intel_context_init() in execlists_create_virtual() as the kref_put() inside would lead to NULL deref on the IOCTL path when sched_engine allocation fails. Discovered using AI-assisted static analysis confirmed by Intel Product Security. Reported-by: Martin Hodo Fixes: 3e28d37146db ("drm/i915: Move priolist to new i915_sched_engine object") Cc: Matthew Brost Cc: Daniele Ceraolo Spurio Cc: Tvrtko Ursulin Cc: # v5.15+ Signed-off-by: Joonas Lahtinen Reviewed-by: Andi Shyti Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20260701114513.221254-1-joonas.lahtinen@linux.intel.com (cherry picked from commit 4f2a12f2d50e9f48227656e4dcbd6423506be31d) Signed-off-by: Rodrigo Vivi Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/i915/gt/intel_execlists_submission.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) --- a/drivers/gpu/drm/i915/gt/intel_execlists_submission.c +++ b/drivers/gpu/drm/i915/gt/intel_execlists_submission.c @@ -3932,11 +3932,11 @@ execlists_create_virtual(struct intel_en struct drm_i915_private *i915 = siblings[0]->i915; struct virtual_engine *ve; unsigned int n; - int err; + int err = -ENOMEM; ve = kzalloc_flex(*ve, siblings, count); if (!ve) - return ERR_PTR(-ENOMEM); + goto err; ve->base.i915 = i915; ve->base.gt = siblings[0]->gt; @@ -3968,10 +3968,8 @@ execlists_create_virtual(struct intel_en intel_engine_init_execlists(&ve->base); ve->base.sched_engine = i915_sched_engine_create(ENGINE_VIRTUAL); - if (!ve->base.sched_engine) { - err = -ENOMEM; - goto err_put; - } + if (!ve->base.sched_engine) + goto err_noput; ve->base.sched_engine->private_data = &ve->base; ve->base.cops = &virtual_context_ops; @@ -3987,10 +3985,8 @@ execlists_create_virtual(struct intel_en intel_context_init(&ve->context, &ve->base); ve->base.breadcrumbs = intel_breadcrumbs_create(NULL); - if (!ve->base.breadcrumbs) { - err = -ENOMEM; + if (!ve->base.breadcrumbs) goto err_put; - } for (n = 0; n < count; n++) { struct intel_engine_cs *sibling = siblings[n]; @@ -4065,8 +4061,13 @@ execlists_create_virtual(struct intel_en virtual_engine_initial_hint(ve); return &ve->context; +err_noput: + kfree(ve); + goto err; + err_put: intel_context_put(&ve->context); +err: return ERR_PTR(err); }