[PATCH 1/2] drm/xe: Fix possible exec queue leak in exec IOCTL

[Matthew Brost]

On Mon, Nov 04, 2024 at 09:44:26PM -0500, Rodrigo Vivi wrote:
> On Mon, Nov 04, 2024 at 04:38:30PM -0800, Matthew Brost wrote:
> > In a couple of places after an exec queue is looked up the exec IOCTL
> > returns on input errors without dropping the exec queue ref. Fix this
> > ensuring the exec queue ref is dropped on input error.
> > 
> > Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
> > Cc: stable <stable at kernel.org>
> > Signed-off-by: Matthew Brost <matthew.brost at intel.com>
> 
> > ---
> >  drivers/gpu/drm/xe/xe_exec.c | 12 ++++++++----
> >  1 file changed, 8 insertions(+), 4 deletions(-)
> > 
> > diff --git a/drivers/gpu/drm/xe/xe_exec.c b/drivers/gpu/drm/xe/xe_exec.c
> > index f23ac1e2ed88..6de12f91b865 100644
> > --- a/drivers/gpu/drm/xe/xe_exec.c
> > +++ b/drivers/gpu/drm/xe/xe_exec.c
> > @@ -132,12 +132,16 @@ int xe_exec_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
> >  	if (XE_IOCTL_DBG(xe, !q))
> >  		return -ENOENT;
> >  
> > -	if (XE_IOCTL_DBG(xe, q->flags & EXEC_QUEUE_FLAG_VM))
> > -		return -EINVAL;
> > +	if (XE_IOCTL_DBG(xe, q->flags & EXEC_QUEUE_FLAG_VM)) {
> > +		err = -EINVAL;
> > +		goto err_exec_queue;
> > +	}
> >  
> >  	if (XE_IOCTL_DBG(xe, args->num_batch_buffer &&
> > -			 q->width != args->num_batch_buffer))
> > -		return -EINVAL;
> > +			 q->width != args->num_batch_buffer)) {
> > +		err = -EINVAL;
> > +		goto err_exec_queue;
> 
> this function is so huge... it probably deserves some splits...
> but the patch is correct
> 

Thanks for the review. Yes, big function. Let me look at this, I see a
couple of logical places to split.

But I think in general our exec IOCTL is pretty tidy...

mbrost at lstrano-desk:xe$ wc xe_exec.c
  354  1320 10399 xe_exec.c
mbrost at lstrano-desk:xe$ wc ../i915/gem/i915_gem_execbuffer.c
 3645 11483 95597 ../i915/gem/i915_gem_execbuffer.c

Matt

> Reviewed-by: Rodrigo Vivi <rodrigo.vivi at intel.com>
> 
> > +	}
> >  
> >  	if (XE_IOCTL_DBG(xe, q->ops->reset_status(q))) {
> >  		err = -ECANCELED;
> > -- 
> > 2.34.1
> >