diff mbox series

[v2] drm/i915: Fixed NULL pointer dereference in capture_engine

Message ID jpbxlab2hz4gozye45lcl635zc4nrfb7rsrvgk4jlfgww2yo6g@qriixepb57au (mailing list archive)
State New, archived
Headers show
Series [v2] drm/i915: Fixed NULL pointer dereference in capture_engine | expand

Commit Message

Eugene Kobyak Nov. 20, 2024, 3:03 p.m. UTC
When the intel_context structure contains NULL,
it raises a NULL pointer dereference error in drm_info().

This patch aims to resolve issue:
https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/12309

Signed-off-by: Eugene Kobyak <eugene.kobyak@intel.com>
---
 drivers/gpu/drm/i915/i915_gpu_error.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

Comments

Andi Shyti Nov. 20, 2024, 3:12 p.m. UTC | #1
Hi Eugene,

On Wed, Nov 20, 2024 at 03:03:29PM +0000, Eugene Kobyak wrote:
> When the intel_context structure contains NULL,
> it raises a NULL pointer dereference error in drm_info().
> 
> This patch aims to resolve issue:
> https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/12309
> 
> Signed-off-by: Eugene Kobyak <eugene.kobyak@intel.com>

Looks better, but you forgot:

Fixes: e8a3319c31a1 ("drm/i915: Allow error capture without a request")
Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/12309
Cc: John Harrison <John.C.Harrison@Intel.com>
Cc: <stable@vger.kernel.org> # v6.3+

(Note the second line, Closes, this is how the gitlab issue
should be reported).

No worries, if John doesn't have anything agains, I can fix it.

But I was actually thinking here that the guc_id can be also
taken from engine->guc_id, I think it's the same.

Andi
John Harrison Nov. 21, 2024, 11:44 p.m. UTC | #2
On 11/20/2024 07:03, Eugene Kobyak wrote:
> When the intel_context structure contains NULL,
> it raises a NULL pointer dereference error in drm_info().
>
> This patch aims to resolve issue:
> https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/12309
>
> Signed-off-by: Eugene Kobyak <eugene.kobyak@intel.com>
> ---
>   drivers/gpu/drm/i915/i915_gpu_error.c | 7 +++++--
>   1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/i915/i915_gpu_error.c b/drivers/gpu/drm/i915/i915_gpu_error.c
> index 135ded17334e..acf403e4e5d6 100644
> --- a/drivers/gpu/drm/i915/i915_gpu_error.c
> +++ b/drivers/gpu/drm/i915/i915_gpu_error.c
> @@ -1643,9 +1643,12 @@ capture_engine(struct intel_engine_cs *engine,
>   		return NULL;
>   
>   	intel_engine_get_hung_entity(engine, &ce, &rq);
> -	if (rq && !i915_request_started(rq))
> +	if (rq && !i915_request_started(rq)) {
> +		u16 guc_id = ce ? ce->guc_id.id : 0;
Note that zero is a valid GuC id. You should either set it to -1 or 
actually make the print conditional to not include the id at all.

John.

> +
>   		drm_info(&engine->gt->i915->drm, "Got hung context on %s with active request %lld:%lld [0x%04X] not yet started\n",
> -			 engine->name, rq->fence.context, rq->fence.seqno, ce->guc_id.id);
> +			 engine->name, rq->fence.context, rq->fence.seqno, guc_id);
> +	}
>   
>   	if (rq) {
>   		capture = intel_engine_coredump_add_request(ee, rq, ATOMIC_MAYFAIL);
diff mbox series

Patch

diff --git a/drivers/gpu/drm/i915/i915_gpu_error.c b/drivers/gpu/drm/i915/i915_gpu_error.c
index 135ded17334e..acf403e4e5d6 100644
--- a/drivers/gpu/drm/i915/i915_gpu_error.c
+++ b/drivers/gpu/drm/i915/i915_gpu_error.c
@@ -1643,9 +1643,12 @@  capture_engine(struct intel_engine_cs *engine,
 		return NULL;
 
 	intel_engine_get_hung_entity(engine, &ce, &rq);
-	if (rq && !i915_request_started(rq))
+	if (rq && !i915_request_started(rq)) {
+		u16 guc_id = ce ? ce->guc_id.id : 0;
+
 		drm_info(&engine->gt->i915->drm, "Got hung context on %s with active request %lld:%lld [0x%04X] not yet started\n",
-			 engine->name, rq->fence.context, rq->fence.seqno, ce->guc_id.id);
+			 engine->name, rq->fence.context, rq->fence.seqno, guc_id);
+	}
 
 	if (rq) {
 		capture = intel_engine_coredump_add_request(ee, rq, ATOMIC_MAYFAIL);