Skip to content

Commit edd2eda

Browse files
jlahtine-intelgregkh
authored andcommitted
drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU
commit 2b56757 upstream. Setting context engine slot N into I915_ENGINE_CLASS_INVALID / I915_ENGINE_CLASS_INVALID_NONE and attempting to apply I915_CONTEXT_PARAM_SSEU to the same slot N will deref NULL. Fix that. Discovered using AI-assisted static analysis confirmed by Intel Product Security. Reported-by: Martin Hodo <martin.hodo@intel.com> Fixes: d4433c7 ("drm/i915/gem: Use the proto-context to handle create parameters (v5)") Cc: Faith Ekstrand <faith.ekstrand@collabora.com> Cc: Simona Vetter <simona.vetter@ffwll.ch> Cc: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: <stable@vger.kernel.org> # v5.15+ Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com> Link: https://patch.msgid.link/20260701075555.52142-1-joonas.lahtinen@linux.intel.com (cherry picked from commit 36eda5b) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent f014702 commit edd2eda

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

drivers/gpu/drm/i915/gem/i915_gem_context.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -855,7 +855,7 @@ static int set_proto_ctx_sseu(struct drm_i915_file_private *fpriv,
855855
pe = &pc->user_engines[idx];
856856

857857
/* Only render engine supports RPCS configuration. */
858-
if (pe->engine->class != RENDER_CLASS)
858+
if (!pe->engine || pe->engine->class != RENDER_CLASS)
859859
return -EINVAL;
860860

861861
sseu = &pe->sseu;

0 commit comments

Comments
 (0)