[PATCH 2/2] drm/i915/guc: Reject unsolicited deregister-done G2H

[Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>]

intel_guc_deregister_done_process_msg() takes the ctx_id straight out of
the G2H payload, resolves it via g2h_context_lookup() and then calls
decr_outstanding_submission_g2h() unconditionally. Ensure that we are
expecting a DEREGISTER_DONE G2H for that context before changing
outstanding_submission state. Return EPROTO on error.

Fixes: b97060a99b01 ("drm/i915/guc: Update intel_gt_wait_for_idle to work with GuC")
Reported-by: Martin Hodo <martin.hodo@intel.com>
Signed-off-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
Assisted-by: Claude:claude-opus-5
---
 drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
index 9d3bd16adf40..85fbef30dbec 100644
--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
+++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
@@ -5065,6 +5065,18 @@ int intel_guc_deregister_done_process_msg(struct intel_guc *guc,
 	if (unlikely(!ce))
 		return -EPROTO;
 
+	/*
+	 * A deregister H2G is only ever sent for a context that has been put in
+	 * one of these two states first, so anything else means this G2H does
+	 * not correspond to an outstanding request of ours.
+	 */
+	if (unlikely(!context_wait_for_deregister_to_register(ce) &&
+		     !context_destroyed(ce))) {
+		guc_err(guc, "Unexpected deregister done, ctx_id %u sched_state 0x%x\n",
+			ctx_id, ce->guc_state.sched_state);
+		return -EPROTO;
+	}
+
 	trace_intel_context_deregister_done(ce);
 
 #ifdef CONFIG_DRM_I915_SELFTEST
-- 
2.53.0