[PATCH] drm/xe: Drop trace_xe_hw_fence_free

Matthew Brost matthew.brost at intel.com
Mon Jul 8 21:10:08 UTC 2024


fence->ctx may be stale memory when trace_xe_hw_fence_free is called
resuling UAF bug when deriving the device name. This tracepoint is not
all that useful, so just drop it.

Fixes: 501c4255c409 ("drm/xe/trace: Print device_id in xe_trace events")
Cc: Ville Syrjälä <ville.syrjala at linux.intel.com>
Cc: Lucas De Marchi <lucas.demarchi at intel.com>
Cc: Gustavo Sousa <gustavo.sousa at intel.com>
Cc: Radhakrishna Sripada <radhakrishna.sripada at intel.com>
Cc: Matt Roper <matthew.d.roper at intel.com>
Signed-off-by: Matthew Brost <matthew.brost at intel.com>
---
 drivers/gpu/drm/xe/xe_hw_fence.c | 1 -
 drivers/gpu/drm/xe/xe_trace.h    | 5 -----
 2 files changed, 6 deletions(-)

diff --git a/drivers/gpu/drm/xe/xe_hw_fence.c b/drivers/gpu/drm/xe/xe_hw_fence.c
index 35c0063a831a..45a9789cf501 100644
--- a/drivers/gpu/drm/xe/xe_hw_fence.c
+++ b/drivers/gpu/drm/xe/xe_hw_fence.c
@@ -187,7 +187,6 @@ static void xe_hw_fence_release(struct dma_fence *dma_fence)
 {
 	struct xe_hw_fence *fence = to_xe_hw_fence(dma_fence);
 
-	trace_xe_hw_fence_free(fence);
 	XE_WARN_ON(!list_empty(&fence->irq_link));
 	call_rcu(&dma_fence->rcu, fence_free);
 }
diff --git a/drivers/gpu/drm/xe/xe_trace.h b/drivers/gpu/drm/xe/xe_trace.h
index 09ca1ad057b0..baba14fb1e32 100644
--- a/drivers/gpu/drm/xe/xe_trace.h
+++ b/drivers/gpu/drm/xe/xe_trace.h
@@ -341,11 +341,6 @@ DEFINE_EVENT(xe_hw_fence, xe_hw_fence_try_signal,
 	     TP_ARGS(fence)
 );
 
-DEFINE_EVENT(xe_hw_fence, xe_hw_fence_free,
-	     TP_PROTO(struct xe_hw_fence *fence),
-	     TP_ARGS(fence)
-);
-
 TRACE_EVENT(xe_reg_rw,
 	TP_PROTO(struct xe_gt *gt, bool write, u32 reg, u64 val, int len),
 
-- 
2.34.1



More information about the Intel-xe mailing list