Skip to content

Commit 488975c

Browse files
harishchegondilucasdemarchi
authored andcommitted
drm/xe/eustall: Fix a possible pointer dereference after free
If devm_add_action_or_reset() isn't successful, xe_eu_stall_fini() is invoked. So, unsuccessful return from devm_add_action_or_reset() shouldn't dereference gt->eu_stall as xe_eu_stall_fini() already frees it. Fix this issue. Fixes: 9a0b11d ("drm/xe/eustall: Add support to init, enable and disable EU stall sampling") Signed-off-by: Harish Chegondi <harish.chegondi@intel.com> Reviewed-by: Ashutosh Dixit <ashutosh.dixit@intel.com> Signed-off-by: Ashutosh Dixit <ashutosh.dixit@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/eae49a414a7314921108e0388810aaee6261ad92.1741800396.git.harish.chegondi@intel.com (cherry picked from commit 278469f) Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
1 parent 5da39dc commit 488975c

File tree

1 file changed

+1
-7
lines changed

1 file changed

+1
-7
lines changed

drivers/gpu/drm/xe/xe_eu_stall.c

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -222,13 +222,7 @@ int xe_eu_stall_init(struct xe_gt *gt)
222222
goto exit_free;
223223
}
224224

225-
ret = devm_add_action_or_reset(xe->drm.dev, xe_eu_stall_fini, gt);
226-
if (ret)
227-
goto exit_destroy;
228-
229-
return 0;
230-
exit_destroy:
231-
destroy_workqueue(gt->eu_stall->buf_ptr_poll_wq);
225+
return devm_add_action_or_reset(xe->drm.dev, xe_eu_stall_fini, gt);
232226
exit_free:
233227
mutex_destroy(&gt->eu_stall->stream_lock);
234228
kfree(gt->eu_stall);

0 commit comments

Comments
 (0)