From: Chris Wilson chris.p.wilson@intel.com

mainline inclusion from mainline-v6.2-rc1 commit 78a033433a5ae4fee85511ee075bc9a48312c79e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALIK8 CVE: CVE-2022-48893

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=...

--------------------------------

If we abort driver initialisation in the middle of gt/engine discovery, some engines will be fully setup and some not. Those incompletely setup engines only have 'engine->release == NULL' and so will leak any of the common objects allocated.

v2: - Drop the destroy_pinned_context() helper for now. It's not really worth it with just a single callsite at the moment. (Janusz)

Signed-off-by: Chris Wilson chris.p.wilson@intel.com Cc: Janusz Krzysztofik janusz.krzysztofik@linux.intel.com Signed-off-by: Matt Roper matthew.d.roper@intel.com Reviewed-by: Janusz Krzysztofik janusz.krzysztofik@linux.intel.com Link: https://patchwork.freedesktop.org/patch/msgid/20220915232654.3283095-2-matth... Signed-off-by: Yu Liao liaoyu15@huawei.com --- drivers/gpu/drm/i915/gt/intel_engine_cs.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c index c940ac3aae2f..5bec331c0813 100644 --- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c +++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c @@ -905,8 +905,13 @@ int intel_engines_init(struct intel_gt *gt) return err;

err = setup(engine); - if (err) + if (err) { + intel_engine_cleanup_common(engine); return err; + } + + /* The backend should now be responsible for cleanup */ + GEM_BUG_ON(engine->release == NULL);

err = engine_init_common(engine); if (err)