Re: [PATCH] drm/xe/pf: clear pending packet on header init failure

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [Low] The patch introduces a syntax error `rturn copied;` instead of `return copied;`.

Pre-existing issues:
- [High] Memory leak of migration packets across aborted or repeated SAVE operations.
--

--- Patch [1]: [PATCH] drm/xe/pf: clear pending packet on header init failure ---
commit c2701f46b2a82f4a8b22c425cd68c28c08222f7f
Author: Guangshuo Li <lgs201920130244@gmail.com>

drm/xe/pf: clear pending packet on header init failure

This commit drops the pending packet when header initialization fails
after the header has been fully consumed. This prevents a potential
NULL pointer dereference on subsequent writes.

> diff --git a/drivers/gpu/drm/xe/xe_sriov_packet.c b/drivers/gpu/drm/xe/xe_sriov_packet.c
> --- a/drivers/gpu/drm/xe/xe_sriov_packet.c
> +++ b/drivers/gpu/drm/xe/xe_sriov_packet.c
[ ... ]
> @@ -332,11 +333,21 @@ ssize_t xe_sriov_packet_write_single(struct xe_device *xe, unsigned int vfid,
> -	if ((*data)->hdr_remaining)
> +	writing_hdr = (*data)->hdr_remaining;
> +	if (writing_hdr)
>  		copied = pkt_hdr_write(*data, buf, len);
>  	else
>  		copied = pkt_data_write(*data, buf, len);
>  
> +	if (copied < 0) {
> +		if (writing_hdr && !(*data)->hdr_remaining) {
> +			kfree(*data);
> +			*data = NULL;
> +		}
> +
> +		rturn copied;

[Severity: Low]
There is a typo here (rturn instead of return).

> +	}
> +
>  	if ((*data)->hdr_remaining == 0 && (*data)->remaining == 0) {
>  		ret = xe_sriov_pf_migration_restore_produce(xe, vfid, *data);

[Severity: High]
This is a pre-existing issue, but is it possible to leak migration packets
across aborted or repeated save operations?

If userspace initiates a VF migration save operation, aborts it without
reading all packets, and then triggers a new save, will the pointers be
overwritten without freeing the previously allocated packets?

drivers/gpu/drm/xe/xe_sriov_packet.c:pf_descriptor_init() {
    ...
    *desc = data;
    ...
}

drivers/gpu/drm/xe/xe_sriov_packet.c:pf_trailer_init() {
    ...
    *trailer = data;
    ...
}

drivers/gpu/drm/xe/xe_sriov_packet.c:pf_pending_init() {
    ...
    *data = NULL;
    ...
}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260708071502.722393-1-lgs201920130244@gmail.com?part=1