public inbox for intel-xe@lists.freedesktop.org
 help / color / mirror / Atom feed
* [PATCH] drm/xe: Fix potential NULL deref in xe_exec_queue_tlb_inval_last_fence_put_unlocked
@ 2026-04-09  0:34 Shuicheng Lin
  2026-04-09  0:44 ` ✗ CI.checkpatch: warning for " Patchwork
                   ` (6 more replies)
  0 siblings, 7 replies; 9+ messages in thread
From: Shuicheng Lin @ 2026-04-09  0:34 UTC (permalink / raw)
  To: intel-xe; +Cc: Shuicheng Lin, Matthew Brost

xe_exec_queue_tlb_inval_last_fence_put_unlocked() uses q->vm->xe as the
first argument to xe_assert(). This function is called unconditionally
from xe_exec_queue_destroy() for all queues, including kernel queues
that have q->vm == NULL (e.g., queues created during GT init in
xe_gt_record_default_lrcs() with vm=NULL).

While current compilers optimize away the q->vm->xe dereference (even
in CONFIG_DRM_XE_DEBUG=y builds, the compiler pushes the dereference
into the WARN branch that is only taken when the assert condition is
false), the code is semantically incorrect and constitutes undefined
behavior in the C abstract machine for the NULL pointer case.

Use gt_to_xe(q->gt) instead, which is always valid for any exec queue.
This is consistent with how xe_exec_queue_destroy() itself obtains the
xe_device pointer in its own xe_assert at the top of the function.

Fixes: b2d7ec41f2a3 ("drm/xe: Attach last fence to TLB invalidation job queues")
Cc: Matthew Brost <matthew.brost@intel.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
---
 drivers/gpu/drm/xe/xe_exec_queue.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/xe/xe_exec_queue.c b/drivers/gpu/drm/xe/xe_exec_queue.c
index 4603ff08d860..071b8c41df43 100644
--- a/drivers/gpu/drm/xe/xe_exec_queue.c
+++ b/drivers/gpu/drm/xe/xe_exec_queue.c
@@ -1763,7 +1763,7 @@ void xe_exec_queue_tlb_inval_last_fence_put(struct xe_exec_queue *q,
 void xe_exec_queue_tlb_inval_last_fence_put_unlocked(struct xe_exec_queue *q,
 						     unsigned int type)
 {
-	xe_assert(q->vm->xe, type == XE_EXEC_QUEUE_TLB_INVAL_MEDIA_GT ||
+	xe_assert(gt_to_xe(q->gt), type == XE_EXEC_QUEUE_TLB_INVAL_MEDIA_GT ||
 		  type == XE_EXEC_QUEUE_TLB_INVAL_PRIMARY_GT);
 
 	dma_fence_put(q->tlb_inval[type].last_fence);
-- 
2.43.0


^ permalink raw reply related	[flat|nested] 9+ messages in thread
end of thread, other threads:[~2026-04-14 15:42 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-04-09  0:34 [PATCH] drm/xe: Fix potential NULL deref in xe_exec_queue_tlb_inval_last_fence_put_unlocked Shuicheng Lin
2026-04-09  0:44 ` ✗ CI.checkpatch: warning for " Patchwork
2026-04-09  0:45 ` ✗ CI.KUnit: failure " Patchwork
2026-04-09  0:47 ` [PATCH] " Matthew Brost
2026-04-10  1:28 ` ✗ CI.checkpatch: warning for drm/xe: Fix potential NULL deref in xe_exec_queue_tlb_inval_last_fence_put_unlocked (rev2) Patchwork
2026-04-10  1:30 ` ✓ CI.KUnit: success " Patchwork
2026-04-10  2:29 ` ✓ Xe.CI.BAT: " Patchwork
2026-04-10  6:04 ` ✓ Xe.CI.FULL: " Patchwork
2026-04-14 15:42   ` Lin, Shuicheng

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox