From: Dmitriy Okunev In reset_csb_pointers(), drm_clflush_virt_range() is called with a size calculated using sizeof(execlists->csb_status), which returns the size of the pointer rather than the size of the object it points to. This could lead to incomplete cache flushing on 32-bit systems where pointer size differs from u64. Replace sizeof(execlists->csb_status) with sizeof(*execlists->csb_status). Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: dc0406820ee7 ("drm/i915/gt: Drop invalidate_csb_entries") Signed-off-by: Dmitriy Okunev Cc: # v5.19+ --- drivers/gpu/drm/i915/gt/intel_execlists_submission.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/i915/gt/intel_execlists_submission.c b/drivers/gpu/drm/i915/gt/intel_execlists_submission.c index e693b0c9d2a3..9ac67a0cbb1f 100644 --- a/drivers/gpu/drm/i915/gt/intel_execlists_submission.c +++ b/drivers/gpu/drm/i915/gt/intel_execlists_submission.c @@ -2833,7 +2833,7 @@ static void reset_csb_pointers(struct intel_engine_cs *engine) memset(execlists->csb_status, -1, (reset_value + 1) * sizeof(u64)); drm_clflush_virt_range(execlists->csb_status, execlists->csb_size * - sizeof(execlists->csb_status)); + sizeof(*execlists->csb_status)); /* Once more for luck and our trusty paranoia */ ENGINE_WRITE(engine, RING_CONTEXT_STATUS_PTR, -- 2.55.0