[PATCH] drm/i915/gvt: Fix NULL pointer dereference in slot switch

[PATCH] drm/i915/gvt: Fix NULL pointer dereference in slot switch

[Tuo Li]

The running slot is updated to the pending slot before updating the running
context. However, the condition checks the old running context instead of
the newly assigned running slot.

When no pending slot exists, running_slot becomes NULL. If the previous
running_context is non-NULL, the code attempts to access
running_slot->ctx[0], resulting in a NULL pointer dereference.

To fix this possible NULL pointer dereference, check running_slot instead
to ensure that running_context is updated only when a valid slot is
available.

Fixes: 8453d674ae7e ("drm/i915/gvt: vGPU execlist virtualization")
Signed-off-by: Tuo Li <islituo@gmail.com>
---
 drivers/gpu/drm/i915/gvt/execlist.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/gvt/execlist.c b/drivers/gpu/drm/i915/gvt/execlist.c
index 29147a9f162e..763c310f2aaf 100644
--- a/drivers/gpu/drm/i915/gvt/execlist.c
+++ b/drivers/gpu/drm/i915/gvt/execlist.c
@@ -73,7 +73,7 @@ static void switch_virtual_execlist_slot(struct intel_vgpu_execlist *execlist)
 
 	execlist->running_slot = execlist->pending_slot;
 	execlist->pending_slot = NULL;
-	execlist->running_context = execlist->running_context ?
+	execlist->running_context = execlist->running_slot ?
 		&execlist->running_slot->ctx[0] : NULL;
 
 	gvt_dbg_el("[after] running slot %d/context %x pending slot %d\n",
-- 
2.43.0