On Tue, Jun 03, 2025 at 06:42:14PM +0100, Matthew Auld wrote:

Daniele noticed that the fix in commit 2d2be279f1ca ("drm/xe: fix UAF around queue destruction") looks to have been unintentionally removed as part of handling a conflict in some past merge commit. Add it back.

Fixes: ac44ff7cec33 ("Merge tag 'drm-xe-fixes-2024-10-10' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes") Reported-by: Daniele Ceraolo Spurio daniele.ceraolospurio@intel.com Signed-off-by: Matthew Auld matthew.auld@intel.com Cc: Matthew Brost matthew.brost@intel.com

Reviewed-by: Matthew Brost matthew.brost@intel.com

Cc: stable@vger.kernel.org # v6.12+

drivers/gpu/drm/xe/xe_guc_submit.c | 11 +++++++++++ 1 file changed, 11 insertions(+)

diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c index 80f748baad3f..2b61d017eeca 100644 --- a/drivers/gpu/drm/xe/xe_guc_submit.c +++ b/drivers/gpu/drm/xe/xe_guc_submit.c @@ -229,6 +229,17 @@ static bool exec_queue_killed_or_banned_or_wedged(struct xe_exec_queue *q) static void guc_submit_fini(struct drm_device *drm, void *arg) { struct xe_guc *guc = arg;

• struct xe_device *xe = guc_to_xe(guc);
• struct xe_gt *gt = guc_to_gt(guc);
• int ret;
• ret = wait_event_timeout(guc->submission_state.fini_wq,

• 		 xa_empty(&guc->submission_state.exec_queue_lookup),
  

• 		 HZ * 5);
  

• drain_workqueue(xe->destroy_wq);
• xe_gt_assert(gt, ret);

xa_destroy(&guc->submission_state.exec_queue_lookup); } -- 2.49.0