Commit 2e824747 authored by Matthew Auld's avatar Matthew Auld Committed by Thomas Hellström
Browse files

drm/xe/guc_submit: add back fix 

Daniele noticed that the fix in commit 2d2be279 ("drm/xe: fix UAF
around queue destruction") looks to have been unintentionally removed as
part of handling a conflict in some past merge commit. Add it back.

Fixes: ac44ff7c ("Merge tag 'drm-xe-fixes-2024-10-10' of https://gitlab.freedesktop.org/drm/xe/kernel

 into drm-fixes")
Reported-by: default avatarDaniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
Signed-off-by: default avatarMatthew Auld <matthew.auld@intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: <stable@vger.kernel.org> # v6.12+
Reviewed-by: default avatarMatthew Brost <matthew.brost@intel.com>
Link: https://lore.kernel.org/r/20250603174213.1543579-2-matthew.auld@intel.com


(cherry picked from commit 9d9fca62)
Signed-off-by: default avatarThomas Hellström <thomas.hellstrom@linux.intel.com>
parent 69a58ef4

drivers/gpu/drm/xe/xe_guc_submit.c

+11 −0
Original line number Diff line number Diff line
@@ -229,6 +229,17 @@ static bool exec_queue_killed_or_banned_or_wedged(struct xe_exec_queue *q) 
static void guc_submit_fini(struct drm_device *drm, void *arg)

{

	struct xe_guc *guc = arg;

	struct xe_device *xe = guc_to_xe(guc);

	struct xe_gt *gt = guc_to_gt(guc);

	int ret;



	ret = wait_event_timeout(guc->submission_state.fini_wq,

				 xa_empty(&guc->submission_state.exec_queue_lookup),

				 HZ * 5);



	drain_workqueue(xe->destroy_wq);



	xe_gt_assert(gt, ret);



	xa_destroy(&guc->submission_state.exec_queue_lookup);

}