Commit caaf1f44 authored by Matthew Brost's avatar Matthew Brost
Browse files

drm/xe: Drop trace_xe_hw_fence_free 



fence->ctx may be stale memory when trace_xe_hw_fence_free is called
resuling UAF bug when deriving the device name. This tracepoint is not
all that useful, so just drop it.

Fixes: 501c4255 ("drm/xe/trace: Print device_id in xe_trace events")
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Cc: Lucas De Marchi <lucas.demarchi@intel.com>
Cc: Gustavo Sousa <gustavo.sousa@intel.com>
Cc: Radhakrishna Sripada <radhakrishna.sripada@intel.com>
Cc: Matt Roper <matthew.d.roper@intel.com>
Signed-off-by: default avatarMatthew Brost <matthew.brost@intel.com>
Reviewed-by: default avatarRodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240708211008.956384-1-matthew.brost@intel.com
parent 74e30768

drivers/gpu/drm/xe/xe_hw_fence.c

+0 −1
Original line number Diff line number Diff line
@@ -187,7 +187,6 @@ static void xe_hw_fence_release(struct dma_fence *dma_fence) 
{

	struct xe_hw_fence *fence = to_xe_hw_fence(dma_fence);



	trace_xe_hw_fence_free(fence);

	XE_WARN_ON(!list_empty(&fence->irq_link));

	call_rcu(&dma_fence->rcu, fence_free);

}

drivers/gpu/drm/xe/xe_trace.h

+0 −5
Original line number Diff line number Diff line
@@ -341,11 +341,6 @@ DEFINE_EVENT(xe_hw_fence, xe_hw_fence_try_signal, 
	     TP_ARGS(fence)

);



DEFINE_EVENT(xe_hw_fence, xe_hw_fence_free,

	     TP_PROTO(struct xe_hw_fence *fence),

	     TP_ARGS(fence)

);



TRACE_EVENT(xe_reg_rw,

	TP_PROTO(struct xe_gt *gt, bool write, u32 reg, u64 val, int len),