[PATCH 1/2] drm/xe: Fix possible exec queue leak in exec IOCTL

[Rodrigo Vivi]

On Mon, Nov 04, 2024 at 04:38:30PM -0800, Matthew Brost wrote:
> In a couple of places after an exec queue is looked up the exec IOCTL
> returns on input errors without dropping the exec queue ref. Fix this
> ensuring the exec queue ref is dropped on input error.
> 
> Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
> Cc: stable <stable at kernel.org>
> Signed-off-by: Matthew Brost <matthew.brost at intel.com>

> ---
>  drivers/gpu/drm/xe/xe_exec.c | 12 ++++++++----
>  1 file changed, 8 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_exec.c b/drivers/gpu/drm/xe/xe_exec.c
> index f23ac1e2ed88..6de12f91b865 100644
> --- a/drivers/gpu/drm/xe/xe_exec.c
> +++ b/drivers/gpu/drm/xe/xe_exec.c
> @@ -132,12 +132,16 @@ int xe_exec_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
>  	if (XE_IOCTL_DBG(xe, !q))
>  		return -ENOENT;
>  
> -	if (XE_IOCTL_DBG(xe, q->flags & EXEC_QUEUE_FLAG_VM))
> -		return -EINVAL;
> +	if (XE_IOCTL_DBG(xe, q->flags & EXEC_QUEUE_FLAG_VM)) {
> +		err = -EINVAL;
> +		goto err_exec_queue;
> +	}
>  
>  	if (XE_IOCTL_DBG(xe, args->num_batch_buffer &&
> -			 q->width != args->num_batch_buffer))
> -		return -EINVAL;
> +			 q->width != args->num_batch_buffer)) {
> +		err = -EINVAL;
> +		goto err_exec_queue;

this function is so huge... it probably deserves some splits...
but the patch is correct

Reviewed-by: Rodrigo Vivi <rodrigo.vivi at intel.com>

> +	}
>  
>  	if (XE_IOCTL_DBG(xe, q->ops->reset_status(q))) {
>  		err = -ECANCELED;
> -- 
> 2.34.1
>