kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers/gpu/drm
History
Sebastian Brzezinka 70d3e622b1 drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat 
commit 4c71fd0995 upstream.

A use-after-free / refcount underflow is possible when the heartbeat
worker and intel_engine_park_heartbeat() race to release the same
engine->heartbeat.systole request.

The heartbeat worker reads engine->heartbeat.systole and calls
i915_request_put() on it when the request is complete, but clears
the pointer in a separate, non-atomic step. Concurrently, a request
retirement on another CPU can drop the engine wakeref to zero, triggering
__engine_park() -> intel_engine_park_heartbeat(). If the heartbeat
timer is pending at that point, cancel_delayed_work() returns true and
intel_engine_park_heartbeat() reads the stale non-NULL systole pointer
and calls i915_request_put() on it again, causing a refcount underflow:

```
<4> [487.221889] Workqueue: i915-unordered engine_retire [i915]
<4> [487.222640] RIP: 0010:refcount_warn_saturate+0x68/0xb0
...
<4> [487.222707] Call Trace:
<4> [487.222711]  <TASK>
<4> [487.222716]  intel_engine_park_heartbeat.part.0+0x6f/0x80 [i915]
<4> [487.223115]  intel_engine_park_heartbeat+0x25/0x40 [i915]
<4> [487.223566]  __engine_park+0xb9/0x650 [i915]
<4> [487.223973]  ____intel_wakeref_put_last+0x2e/0xb0 [i915]
<4> [487.224408]  __intel_wakeref_put_last+0x72/0x90 [i915]
<4> [487.224797]  intel_context_exit_engine+0x7c/0x80 [i915]
<4> [487.225238]  intel_context_exit+0xf1/0x1b0 [i915]
<4> [487.225695]  i915_request_retire.part.0+0x1b9/0x530 [i915]
<4> [487.226178]  i915_request_retire+0x1c/0x40 [i915]
<4> [487.226625]  engine_retire+0x122/0x180 [i915]
<4> [487.227037]  process_one_work+0x239/0x760
<4> [487.227060]  worker_thread+0x200/0x3f0
<4> [487.227068]  ? __pfx_worker_thread+0x10/0x10
<4> [487.227075]  kthread+0x10d/0x150
<4> [487.227083]  ? __pfx_kthread+0x10/0x10
<4> [487.227092]  ret_from_fork+0x3d4/0x480
<4> [487.227099]  ? __pfx_kthread+0x10/0x10
<4> [487.227107]  ret_from_fork_asm+0x1a/0x30
<4> [487.227141]  </TASK>
```

Fix this by replacing the non-atomic pointer read + separate clear with
xchg() in both racing paths. xchg() is a single indivisible hardware
instruction that atomically reads the old pointer and writes NULL. This
guarantees only one of the two concurrent callers obtains the non-NULL
pointer and performs the put, the other gets NULL and skips it.

Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/work_items/15880
Fixes: 058179e72e ("drm/i915/gt: Replace hangcheck by heartbeats")
Cc: <stable@vger.kernel.org> # v5.5+
Signed-off-by: Sebastian Brzezinka <sebastian.brzezinka@intel.com>
Reviewed-by: Krzysztof Karas <krzysztof.karas@intel.com>
Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
Signed-off-by: Andi Shyti <andi.shyti@linux.intel.com>
Link: https://lore.kernel.org/r/d4c1c14255688dd07cc8044973c4f032a8d1559e.1775038106.git.sebastian.brzezinka@intel.com
(cherry picked from commit 13238dc0ee)
Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-04-18 10:33:37 +02:00
..
amd drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink 2026-04-18 10:33:19 +02:00
arm minmax: add in_range() macro 2025-10-19 16:21:28 +02:00
armada drm/armada: Fix off-by-one error in armada_overlay_get_property() 2023-09-19 12:22:38 +02:00
aspeed drm/aspeed: Fix vga_pw sysfs output 2021-12-01 09:04:47 +01:00
ast drm/ast: dp501: Fix initialization of SCU2C 2026-04-18 10:33:32 +02:00
atmel-hlcdc drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release 2026-03-04 07:20:05 -05:00
bridge drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts 2025-12-07 06:09:19 +09:00
etnaviv drm/etnaviv: fix flush sequence logic 2025-12-07 06:09:14 +09:00
exynos drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free 2026-04-18 10:33:18 +02:00
fsl-dcu drm: fsl-dcu: enable PIXCLK on LS1021A 2024-12-14 19:50:55 +01:00
gma500 drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() 2026-01-19 13:10:11 +01:00
gud drm/gud: Get offset-adjusted mapping from drm_gem_fb_vmap() 2021-08-08 20:27:24 +02:00
hisilicon drm/hisilicon/hibmc: fix the hibmc loaded failed bug 2025-08-28 16:24:38 +02:00
hyperv drm/hyperv: Don't overwrite dirt_needed value set by host 2023-05-17 11:50:15 +02:00
i2c sound updates for 5.9 2020-08-06 14:27:31 -07:00
i810 drm: IRQ midlayer is now legacy 2021-08-10 20:14:01 +02:00
i915 drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat 2026-04-18 10:33:37 +02:00
imx drm/imx/tve: fix probe device leak 2026-02-06 16:42:05 +01:00
ingenic drm/ingenic: Fix missing platform_driver_unregister() call in ingenic_drm_init() 2023-01-12 11:59:00 +01:00
kmb drm/kmb: Fix for build errors with Warray-bounds 2022-02-08 18:34:09 +01:00
lib License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
lima drm/lima: set gp bus_stop bit before hard reset 2024-09-04 13:23:24 +02:00
mcde drm/mcde: Enable module autoloading 2024-12-14 19:51:36 +01:00
mediatek drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue 2026-01-19 13:09:31 +01:00
meson drm/meson: Use 1000ULL when operating with mode->clock 2025-06-27 11:05:22 +01:00
mga drm: IRQ midlayer is now legacy 2021-08-10 20:14:01 +02:00
mgag200 drm/mgag200: Set DDC timeout in milliseconds 2024-08-19 05:45:47 +02:00
msm drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers 2026-01-19 13:10:03 +01:00
mxsfb drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC 2023-03-10 09:39:19 +01:00
nouveau nouveau/dpcd: return EBUSY for aux xfer if the device is asleep 2026-04-18 10:33:15 +02:00
omapdrm drm/omap: Fix locking in omap_gem_new_dmabuf() 2024-12-14 19:50:51 +01:00
panel drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel 2026-02-06 16:41:49 +01:00
panfrost drm/panfrost: Remove unused id_mask from struct panfrost_model 2024-12-14 19:50:55 +01:00
pl111 drm/pl111: Fix error handling in pl111_amba_probe 2026-01-19 13:10:14 +01:00
qxl drm/qxl: Add check for drm_cvt_mode 2024-08-19 05:45:02 +02:00
r128 drm/r128: fix build for UML 2021-10-15 15:05:10 +10:00
radeon drm/radeon: apply state adjust rules to some additional HAINAN vairants 2026-04-18 10:33:18 +02:00
rcar-du drm: rcar-du: Fix memory leak in rcar_du_vsps_init() 2025-06-27 11:05:11 +01:00
rockchip drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed 2025-08-28 16:24:07 +02:00
savage drm/savage: Remove references to struct drm_device.pdev 2021-05-03 19:48:30 +02:00
scheduler drm/sched: Fix race in drm_sched_entity_select_rq() 2025-12-07 06:09:15 +09:00
selftests drm/selftests/test-drm_dp_mst_helper: Fix memory leak in sideband_msg_req_encode_decode 2022-04-08 14:23:24 +02:00
shmobile drm/shmobile: Convert to Linux IRQ interfaces 2021-07-25 11:01:12 +02:00
sis drm/sis: Remove references to struct drm_device.pdev 2021-05-03 19:48:33 +02:00
sti drm: sti: fix device leaks at component probe 2025-12-07 06:09:36 +09:00
stm drm/stm: Fix an error handling path in stm_drm_platform_probe() 2024-10-17 15:10:51 +02:00
sun4i drm: sun4i_tcon: use devm_clk_get_enabled in sun4i_tcon_init_clocks 2023-07-23 13:46:59 +02:00
tdfx drm: Constify drm_driver in drivers that don't modify it 2021-01-05 07:20:36 +02:00
tegra drm/tegra: dsi: fix device leak on probe 2026-04-18 10:33:07 +02:00
tidss drm/tidss: Set crtc modesetting parameters with adjusted mode 2025-12-07 06:09:18 +09:00
tilcdc drm/tilcdc: Fix irq free on unload 2024-01-25 14:52:41 -08:00
tiny drm/repaper: fix integer overflows in repeat functions 2025-05-02 07:44:14 +02:00
ttm drm/ttm: Avoid NULL pointer deref for evicted BOs 2026-01-19 13:10:03 +01:00
tve200 drm/tiny: drm_gem_simple_display_pipe_prepare_fb is the default 2021-06-24 15:40:11 +02:00
udl drm/udl: Unregister device before cleaning up on disconnect 2025-07-10 15:57:40 +02:00
v3d drm/v3d: Set DMA segment size to avoid debug warnings 2026-03-04 07:20:02 -05:00
vboxvideo drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA 2024-11-01 01:52:35 +01:00
vc4 drm/vc4: hvs: Set AXI panic modes for the HVS 2024-12-14 19:51:35 +01:00
vgem drm/vgem-fence: Fix potential deadlock on release 2026-01-19 13:09:22 +01:00
via drm: IRQ midlayer is now legacy 2021-08-10 20:14:01 +02:00
virtio drm/virtio: Fix error code in virtio_gpu_object_shmem_init() 2023-03-11 13:57:40 +01:00
vkms drm/vkms: Adjust vkms_state->active_planes allocation type 2025-06-27 11:05:11 +01:00
vmwgfx drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() 2026-02-06 16:41:49 +01:00
xen drm/tiny: drm_gem_simple_display_pipe_prepare_fb is the default 2021-06-24 15:40:11 +02:00
xlnx drm: xlnx: zynqmp: Fix max dma segment size 2025-04-10 14:31:58 +02:00
zte drm/zte: Don't set struct drm_device.irq_enabled 2021-06-29 15:40:53 +02:00
drm_agpsupport.c drm: Include <asm/agp.h> iff CONFIG_AGP is set 2021-05-11 14:13:33 +02:00
drm_aperture.c drm/aperture: Run fbdev removal before internal helpers 2022-07-21 21:24:44 +02:00
drm_atomic.c drm/atomic: Fix potential use-after-free in nonblocking commits 2023-07-23 13:47:58 +02:00
drm_atomic_helper.c drm: Add valid clones check 2025-06-04 14:38:04 +02:00
drm_atomic_state_helper.c drm: fix some kernel-doc markups 2020-11-16 20:48:20 +01:00
drm_atomic_uapi.c drm/atomic: Filter out redundant DPMS calls 2025-04-10 14:31:52 +02:00
drm_auth.c drm: add lockdep assert to drm_is_current_master_locked 2021-08-05 12:08:15 +02:00
drm_blend.c drm: drm_blend.c: Use tabs for code indents 2021-04-22 10:46:35 +02:00
drm_bridge.c drm/bridge: Avoid uninitialized variable warning 2022-10-26 12:34:50 +02:00
drm_bridge_connector.c drm/bridge_connector: enable HPD by default if supported 2022-06-09 10:22:44 +02:00
drm_bufs.c drm: Fix typo in comments 2021-08-02 10:19:43 +02:00
drm_cache.c drm: Fix typo in comments 2021-08-02 10:19:43 +02:00
drm_client.c drm/client: Depend on GEM object kmap ref-counting 2020-11-24 09:27:54 +01:00
drm_client_modeset.c drm/client: fix null pointer dereference in drm_client_modeset_probe 2024-08-19 05:45:43 +02:00
drm_color_mgmt.c minmax: add a few more MIN_T/MAX_T users 2025-10-19 16:21:52 +02:00
drm_connector.c drm/atomic: Filter out redundant DPMS calls 2025-04-10 14:31:52 +02:00
drm_context.c drm: correct function name drm_legacy_ctxbitmap_flush() 2021-05-16 22:01:14 +02:00
drm_crtc.c drm/crtc: fix uninitialized variable use even harder 2024-10-17 15:11:48 +02:00
drm_crtc_helper.c drm : Insert blank lines after declarations. 2020-07-02 15:26:00 +02:00
drm_crtc_helper_internal.h drm: remove drm_fb_helper_modinit 2021-02-08 12:20:38 +01:00
drm_crtc_internal.h Backmerge remote-tracking branch 'drm/drm-next' into drm-misc-next 2021-07-27 12:48:17 +02:00
drm_damage_helper.c drm: Fix typo in comments 2021-08-02 10:19:43 +02:00
drm_debugfs.c drm: avoid blocking in drm_clients_info's rcu section 2021-07-20 20:14:42 +02:00
drm_debugfs_crc.c drm/doc: document how userspace should find out CRTC index 2021-06-10 19:14:47 +02:00
drm_displayid.c drm/displayid: add displayid_get_header() and check bounds better 2023-05-24 17:36:43 +01:00
drm_dma.c drm: remove usage of drm_pci_alloc/free 2021-04-26 18:19:15 +02:00
drm_dp_aux_bus.c drm/dp: Export symbol / kerneldoc fixes for DP AUX bus 2022-08-17 14:23:16 +02:00
drm_dp_aux_dev.c drm/dp: Add backpointer to drm_device in drm_dp_aux 2021-04-27 18:43:42 -04:00
drm_dp_cec.c gpu: drm_dp_cec: fix broken CEC adapter properties check 2025-03-13 12:50:22 +01:00
drm_dp_dual_mode_helper.c drm/display: Don't assume dual mode adaptors support i2c sub-addressing 2022-12-02 17:41:00 +01:00
drm_dp_helper.c Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" 2025-09-04 14:28:48 +02:00
drm_dp_mst_topology.c drm/dp_mst: Fix drm RAD print 2025-04-10 14:31:58 +02:00
drm_dp_mst_topology_internal.h drm/dp_mst: Add sideband down request tracing + selftests 2019-09-03 19:30:06 -04:00
drm_drv.c drm/drv: propagate errors from drm_modeset_register_all() 2024-01-25 14:52:42 -08:00
drm_dsc.c drm: Fix typo in comments 2021-08-02 10:19:43 +02:00
drm_dumb_buffers.c drm: Don't export the drm_gem_dumb_destroy() function 2021-01-05 07:20:25 +02:00
drm_edid.c drm/edid: fixed the bug that hdr metadata was not reset 2025-06-04 14:38:06 +02:00
drm_edid_load.c drm/print: add drm_debug_enabled() 2019-10-02 16:28:55 +03:00
drm_encoder.c drm: add drmm_encoder_alloc() 2021-01-04 12:59:33 +01:00
drm_encoder_slave.c drm: encoder_slave: use new I2C API 2020-06-19 09:20:21 +02:00
drm_fb_cma_helper.c drm: Add and export function drm_fb_cma_sync_non_coherent 2021-05-25 11:42:09 +01:00
drm_fb_helper.c drm/modeset: Handle tiled displays in pan_display_atomic. 2025-03-13 12:50:23 +01:00
drm_file.c drm/drm_file: fix use of uninitialized variable 2024-02-23 08:54:46 +01:00
drm_flip_work.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_format_helper.c drm: Fix typo in comments 2021-08-02 10:19:43 +02:00
drm_fourcc.c drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats 2023-03-10 09:39:19 +01:00
drm_framebuffer.c drm/framebuffer: Fix use of uninitialized variable 2024-02-23 08:54:47 +01:00
drm_gem.c drm/gem: Fix race in drm_gem_handle_create_tail() 2025-07-17 18:30:49 +02:00
drm_gem_atomic_helper.c drm/sysfb: Do not dereference NULL pointer in plane reset 2025-12-07 06:09:15 +09:00
drm_gem_cma_helper.c drm/cma-helper: Set VM_DONTEXPAND for mmap 2022-02-23 12:03:09 +01:00
drm_gem_framebuffer_helper.c drm/gem: Provide offset-adjusted framebuffer BO mappings 2021-08-08 20:26:16 +02:00
drm_gem_shmem_helper.c drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE) 2024-10-22 15:40:41 +02:00
drm_gem_ttm_helper.c drm/ttm: fix locking in vmap/vunmap TTM GEM helpers 2022-07-29 17:25:05 +02:00
drm_gem_vram_helper.c drm/vram-helper: fix function names in vram helper doc 2023-07-23 13:46:58 +02:00
drm_hashtab.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_hdcp.c drm: Fix typo in comments 2021-08-02 10:19:43 +02:00
drm_internal.h drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker() 2022-11-26 09:24:37 +01:00
drm_ioc32.c drm/ioc32: stop speculation on the drm_compat_ioctl path 2026-04-18 10:33:31 +02:00
drm_ioctl.c drm: Prevent drm_copy_field() to attempt copying a NULL pointer 2022-10-26 12:35:38 +02:00
drm_irq.c drm: IRQ midlayer is now legacy 2021-08-10 20:14:01 +02:00
drm_kms_helper_common.c drm: remove drm_fb_helper_modinit 2021-02-08 12:20:38 +01:00
drm_lease.c drm: clean up unused kerneldoc in drm_lease.c 2021-07-30 11:55:41 +02:00
drm_legacy.h drm: Mark IRQ_BUSID ioctl as legacy 2021-05-17 21:19:48 +02:00
drm_legacy_misc.c drm: IRQ midlayer is now legacy 2021-08-10 20:14:01 +02:00
drm_lock.c drm : Insert blank lines after declarations. 2020-07-02 15:26:00 +02:00
drm_managed.c drm/dev: Remove drm_dev_init 2020-09-21 10:45:08 +02:00
drm_memory.c drm: Mark AGP implementation and ioctls as legacy 2021-05-10 15:46:58 +02:00
drm_mipi_dbi.c drm/mipi-dbi: align max_chunk to 2 in spi_transfer 2022-08-17 14:23:17 +02:00
drm_mipi_dsi.c Revert "drm/mipi-dsi: Set the fwnode for mipi_dsi_device" 2024-11-08 16:25:56 +01:00
drm_mm.c drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused 2024-12-14 19:50:51 +01:00
drm_mode_config.c drm: Fix potential null-ptr-deref due to drmm_mode_config_init() 2023-03-10 09:39:19 +01:00
drm_mode_object.c drm: Fix typo in comments 2021-08-02 10:19:43 +02:00
drm_modes.c drm/modes: Avoid divide by zero harder in drm_mode_vrefresh() 2025-01-09 13:28:33 +01:00
drm_modeset_helper.c drm: Check output polling initialized before disabling 2024-06-16 13:39:53 +02:00
drm_modeset_lock.c docs conversion for v5.3-rc1 2019-07-16 12:21:41 -07:00
drm_of.c drm/bridge: Add a function to abstract away panels 2022-08-17 14:23:24 +02:00
drm_panel.c drm/bridge: panel: forbid initializing a panel with unknown connector type 2025-05-02 07:43:57 +02:00
drm_panel_orientation_quirks.c drm: panel-orientation-quirks: Add new quirk for GPD Win 2 2025-05-02 07:43:57 +02:00
drm_pci.c drm: Mark IRQ_BUSID ioctl as legacy 2021-05-17 21:19:48 +02:00
drm_plane.c drm: Don't unref the same fb many times by mistake due to deadlock handling 2024-02-23 08:54:32 +01:00
drm_plane_helper.c drm/plane-helper: fix uninitialized variable reference 2021-11-18 19:17:00 +01:00
drm_prime.c drm/prime: Support page array >= 4GB 2024-02-23 08:55:07 +01:00
drm_print.c drm/printer: Allow NULL data in devcoredump printer 2024-10-17 15:11:32 +02:00
drm_probe_helper.c drm/probe-helper: Create a HPD IRQ event helper for a single connector 2025-03-13 12:50:48 +01:00
drm_property.c drm: Account property blob allocations to memcg 2026-03-04 07:20:04 -05:00
drm_rect.c drm/rect: update kerneldoc for drm_rect_clip_scaled() 2019-11-28 13:15:43 +01:00
drm_scatter.c gpu/drm: remove the powerpc hack in drm_legacy_sg_alloc 2020-06-02 10:59:11 -07:00
drm_scdc_helper.c drm: Fix typo in comments 2021-08-02 10:19:43 +02:00
drm_self_refresh_helper.c drm/atomic: fix self-refresh helpers crtc state dereference 2019-11-06 13:00:21 -05:00
drm_simple_kms_helper.c drm/simple-kms: Support custom CRTC state 2021-08-08 20:14:08 +02:00
drm_syncobj.c drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set 2024-03-01 13:22:00 +01:00
drm_sysfs.c drm/sysfs: Convert sysfs sprintf/snprintf family to sysfs_emit 2021-03-23 07:41:39 -04:00
drm_trace.h drm: Add high-precision time to vblank trace event 2019-09-03 09:46:18 +02:00
drm_trace_points.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_vblank.c drm: IRQ midlayer is now legacy 2021-08-10 20:14:01 +02:00
drm_vblank_work.c This tree adds the sched_set_fifo*() encapsulation APIs to remove 2020-08-06 11:55:43 -07:00
drm_vm.c drm: Mark AGP implementation and ioctls as legacy 2021-05-10 15:46:58 +02:00
drm_vma_manager.c drm: Fix typo in comments 2021-08-02 10:19:43 +02:00
drm_writeback.c drm/writeback: don't set fence->ops to default 2020-05-20 20:03:45 +02:00
Kconfig Revert "drm: fb_helper: fix CONFIG_FB dependency" 2021-11-21 13:44:12 +01:00
Makefile drm/bochs: Move to tiny/ 2021-07-05 08:54:44 +02:00