Re: [PATCH i-g-t 1/2] lib/amdgpu: fix NULL deref computing available_rings in amdgpu_create_ip_queues

LGTM, both patches

Reviewed-by: Vitaly Prosyak <[email protected]>

On 2026-08-13 04:03, Jesse Zhang wrote:
> amdgpu_create_ip_queues() dereferenced ring_context->hw_ip_info to compute
> available_rings while ring_context was still NULL - it is only allocated later
> via calloc(). This crashed the all-queues-with-umq subtest with a SIGSEGV in
> amdgpu_create_ip_queues() before any queue was created.
>
> The HW IP info is already queried into the local hw_ip_info at the top of the
> function, so read available_rings from that instead of the not-yet-allocated
> ring_context.
>
> Signed-off-by: Jesse Zhang <[email protected]>
> ---
>  lib/amdgpu/amd_command_submission.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/lib/amdgpu/amd_command_submission.c b/lib/amdgpu/amd_command_submission.c
> index 0334c2ded..7210cffb9 100644
> --- a/lib/amdgpu/amd_command_submission.c
> +++ b/lib/amdgpu/amd_command_submission.c
> @@ -181,10 +181,10 @@ static void amdgpu_create_ip_queues(amdgpu_device_handle device,
>  	amdgpu_dma_limits_query(device, &limits);
>  
>  	if (user_queue)
> -		available_rings = ring_context->hw_ip_info.num_userq_slots ?
> -			((1 << ring_context->hw_ip_info.num_userq_slots) -1) : 1;
> +		available_rings = hw_ip_info.num_userq_slots ?
> +			((1 << hw_ip_info.num_userq_slots) - 1) : 1;
>  	else
> -		available_rings = ring_context->hw_ip_info.available_rings;
> +		available_rings = hw_ip_info.available_rings;
>  
>  	if (available_rings <= 0) {
>  		*ring_context_out = NULL;