✗ CI.checkpatch: warning for drm/xe: fix UAF around queue destruction (rev2)

Patchwork patchwork at emeril.freedesktop.org
Wed Sep 25 20:15:42 UTC 2024


== Series Details ==

Series: drm/xe: fix UAF around queue destruction (rev2)
URL   : https://patchwork.freedesktop.org/series/138931/
State : warning

== Summary ==

+ KERNEL=/kernel
+ git clone https://gitlab.freedesktop.org/drm/maintainer-tools mt
Cloning into 'mt'...
warning: redirecting to https://gitlab.freedesktop.org/drm/maintainer-tools.git/
+ git -C mt rev-list -n1 origin/master
30ab6715fc09baee6cc14cb3c89ad8858688d474
+ cd /kernel
+ git config --global --add safe.directory /kernel
+ git log -n1
commit f83c5b4d20f1d57fcfe70244353a7f213de2ddf6
Author: Matthew Auld <matthew.auld at intel.com>
Date:   Mon Sep 23 15:56:48 2024 +0100

    drm/xe: fix UAF around queue destruction
    
    We currently do stuff like queuing the final destruction step on a
    random system wq, which will outlive the driver instance. With bad
    timing we can teardown the driver with one or more work workqueue still
    being alive leading to various UAF splats. Add a fini step to ensure
    user queues are properly torn down. At this point GuC should already be
    nuked so queue itself should no longer be referenced from hw pov.
    
    v2 (Matt B)
     - Looks much safer to use a waitqueue and then just wait for the
       xa_array to become empty before triggering the drain.
    
    Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2317
    Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
    Signed-off-by: Matthew Auld <matthew.auld at intel.com>
    Cc: Matthew Brost <matthew.brost at intel.com>
    Cc: <stable at vger.kernel.org> # v6.8+
    Reviewed-by: Matthew Brost <matthew.brost at intel.com>
+ /mt/dim checkpatch 88d592f72f7bc508d6a027b1f96aa2e53f803e1b drm-intel
f83c5b4d20f1 drm/xe: fix UAF around queue destruction
-:77: CHECK:OPEN_ENDED_LINE: Lines should not end with a '('
#77: FILE: drivers/gpu/drm/xe/xe_guc_submit.c:285:
+	ret = wait_event_timeout(

total: 0 errors, 0 warnings, 1 checks, 96 lines checked




More information about the Intel-xe mailing list