intel_guc_deregister_done_process_msg() takes the ctx_id straight out of
the G2H payload, resolves it via g2h_context_lookup() and then calls
decr_outstanding_submission_g2h() unconditionally. Ensure that we are
expecting a DEREGISTER_DONE G2H for that context before changing
outstanding_submission state. Return EPROTO on error.
Fixes: b97060a99b01 ("drm/i915/guc: Update intel_gt_wait_for_idle to work with
GuC")
Reported-by: Martin Hodo <[email protected]>
Signed-off-by: Umesh Nerlige Ramappa <[email protected]>
Assisted-by: Claude:claude-opus-5
---
drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
index 9d3bd16adf40..85fbef30dbec 100644
--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
+++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
@@ -5065,6 +5065,18 @@ int intel_guc_deregister_done_process_msg(struct
intel_guc *guc,
if (unlikely(!ce))
return -EPROTO;
+ /*
+ * A deregister H2G is only ever sent for a context that has been put in
+ * one of these two states first, so anything else means this G2H does
+ * not correspond to an outstanding request of ours.
+ */
+ if (unlikely(!context_wait_for_deregister_to_register(ce) &&
+ !context_destroyed(ce))) {
+ guc_err(guc, "Unexpected deregister done, ctx_id %u sched_state
0x%x\n",
+ ctx_id, ce->guc_state.sched_state);
+ return -EPROTO;
+ }
+
trace_intel_context_deregister_done(ce);
#ifdef CONFIG_DRM_I915_SELFTEST
--
2.53.0
