CVE-2026-52976: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()

CVE-2026-52976: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()

Two error handling issues exist in xe_exec_queue_create_ioctl():

1. When xe_hw_engine_group_add_exec_queue() fails, the error path jumps
   to put_exec_queue which skips xe_exec_queue_kill(). If the VM is in
   preempt fence mode, xe_vm_add_compute_exec_queue() has already added
   the queue to the VM's compute exec queue list. Skipping the kill
   leaves the queue on that list, leading to a dangling pointer after
   the queue is freed.

2. When xa_alloc() fails after xe_hw_engine_group_add_exec_queue() has
   succeeded, the error path does not call
   xe_hw_engine_group_del_exec_queue() to remove the queue from the hw
   engine group list. The queue is then freed while still linked into
   the hw engine group, causing a use-after-free.

Fix both by:
- Changing the xe_hw_engine_group_add_exec_queue() failure path to jump
  to kill_exec_queue so that xe_exec_queue_kill() properly removes the
  queue from the VM's compute list.
- Adding a del_hw_engine_group label before kill_exec_queue for the
  xa_alloc() failure path, which removes the queue from the hw engine
  group before proceeding with the rest of the cleanup.

(cherry picked from commit 37c831f401746a45d510b312b0ed7a77b1e06ec8)

The Linux kernel CVE team has assigned CVE-2026-52976 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.12 with commit 7970cb36966c9b9183255dc097ae0446300eebcf and fixed in 6.12.91 with commit f93b00161213a0fe9f7ff1d8498ee5ca9e0a5c43
	Issue introduced in 6.12 with commit 7970cb36966c9b9183255dc097ae0446300eebcf and fixed in 6.18.33 with commit 753b149d5a433eb19e0c1b0eb4526a6e26120d1f
	Issue introduced in 6.12 with commit 7970cb36966c9b9183255dc097ae0446300eebcf and fixed in 7.0.10 with commit 1be55646d8a2035343b012dcb12210db7bb8b056
	Issue introduced in 6.12 with commit 7970cb36966c9b9183255dc097ae0446300eebcf and fixed in 7.1 with commit f3cc22d4df3ed58439ea7e21daa54c3608e03b78

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-52976
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/xe/xe_exec_queue.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/f93b00161213a0fe9f7ff1d8498ee5ca9e0a5c43
	https://git.kernel.org/stable/c/753b149d5a433eb19e0c1b0eb4526a6e26120d1f
	https://git.kernel.org/stable/c/1be55646d8a2035343b012dcb12210db7bb8b056
	https://git.kernel.org/stable/c/f3cc22d4df3ed58439ea7e21daa54c3608e03b78