On Wed, 11 Oct 2023, Nirmoy Das <nirmoy.das@xxxxxxxxx> wrote:
> If measure_breadcrumb_dw() returns an error and bce isn't created,
> this commit ensures that intel_engine_destroy_pinned_context()
> is not called with a NULL bce.
So it's a potential NULL pointer dereference, not use after free like
the subject says. Please fix the subject.
BR,
Jani.
>
> Fixes: b35274993680 ("drm/i915: Create a kernel context for GGTT updates")
> Cc: Oak Zeng <oak.zeng@xxxxxxxxx>
> Cc: Andi Shyti <andi.shyti@xxxxxxxxxxxxxxx>
> Signed-off-by: Nirmoy Das <nirmoy.das@xxxxxxxxx>
> ---
> drivers/gpu/drm/i915/gt/intel_engine_cs.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
> index 179d9546865b..4a11219e560e 100644
> --- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c
> +++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
> @@ -1491,7 +1491,8 @@ static int engine_init_common(struct intel_engine_cs *engine)
> return 0;
>
> err_bce_context:
> - intel_engine_destroy_pinned_context(bce);
> + if (bce)
> + intel_engine_destroy_pinned_context(bce);
> err_ce_context:
> intel_engine_destroy_pinned_context(ce);
> return ret;
--
Jani Nikula, Intel
