Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'drm-xe-next-fixes-2025-11-21' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next
Driver Changes:
- A couple of SR-IOV fixes (Michal Winiarski)
- Fix a potential UAF (Sanjay)
Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Thomas Hellstrom <thomas.hellstrom@linux.intel.com>
Link: https://patch.msgid.link/aSA08EW9JMU3LkIu@fedora
+16
-5
+11
drivers/gpu/drm/xe/xe_gt_sriov_pf_migration.c
+11
drivers/gpu/drm/xe/xe_gt_sriov_pf_migration.c
···
571
571
fence = __pf_save_restore_vram(gt, vfid,
572
572
src_vram, src_vram_offset,
573
573
data->bo, 0, size, true);
574
+
if (IS_ERR(fence)) {
575
+
ret = PTR_ERR(fence);
576
+
goto fail;
577
+
}
574
578
575
579
ret = dma_fence_wait_timeout(fence, false, PF_VRAM_SAVE_RESTORE_TIMEOUT);
576
580
dma_fence_put(fence);
···
658
654
659
655
fence = __pf_save_restore_vram(gt, vfid, vram, data->hdr.offset,
660
656
data->bo, 0, data->hdr.size, false);
657
+
if (IS_ERR(fence)) {
658
+
ret = PTR_ERR(fence);
659
+
goto err;
660
+
}
661
+
661
662
ret = dma_fence_wait_timeout(fence, false, PF_VRAM_SAVE_RESTORE_TIMEOUT);
662
663
dma_fence_put(fence);
663
664
if (!ret) {
664
665
ret = -ETIME;
665
666
goto err;
666
667
}
668
+
669
+
xe_bo_put(vram);
667
670
668
671
return 0;
669
672
err:
+5
-3
drivers/gpu/drm/xe/xe_oa.c
+5
-3
drivers/gpu/drm/xe/xe_oa.c
···
2403
2403
goto sysfs_err;
2404
2404
}
2405
2405
2406
+
id = oa_config->id;
2407
+
2408
+
drm_dbg(&oa->xe->drm, "Added config %s id=%i\n", oa_config->uuid, id);
2409
+
2406
2410
mutex_unlock(&oa->metrics_lock);
2407
2411
2408
-
drm_dbg(&oa->xe->drm, "Added config %s id=%i\n", oa_config->uuid, oa_config->id);
2409
-
2410
-
return oa_config->id;
2412
+
return id;
2411
2413
2412
2414
sysfs_err:
2413
2415
mutex_unlock(&oa->metrics_lock);
-2
drivers/gpu/drm/xe/xe_sriov_pf_migration.c
-2
drivers/gpu/drm/xe/xe_sriov_pf_migration.c
···
148
148
* Return: Pointer to &xe_sriov_packet on success,
149
149
* NULL if ring is empty and no more migration data is expected,
150
150
* ERR_PTR value in case of error.
151
-
*
152
-
* Return: 0 on success or a negative error code on failure.
153
151
*/
154
152
struct xe_sriov_packet *
155
153
xe_sriov_pf_migration_save_consume(struct xe_device *xe, unsigned int vfid)