Re: [PATCH] drm/xe: Account for exec queue cleanup after handle allocation fails

[Matthew Brost <matthew.brost@intel.com>]

On Fri, Nov 13, 2026 at 12:24:36PM +0530, Arvind Yadav wrote:
> xe_exec_queue_create_ioctl() assigns q->xef before allocating the
> userspace handle. If xa_alloc() fails, queue finalization decrements
> pending_removal even though the queue was never removed from the
> xarray and the counter was never incremented.
> 
> This can leave pending_removal negative and block fdinfo readers
> waiting for it to reach zero.
> 
> Increment pending_removal before unwinding the failed allocation.
> The existing finalization path balances the increment.
> 
> Fixes: 0fd4380c050d ("drm/xe: Wait on killed exec queues")
> Cc: Matthew Brost <matthew.brost@intel.com>
> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
> Cc: Tejas Upadhyay <tejas.upadhyay@intel.com>
> Assisted-by: LLM
> Closes: https://sashiko.dev/#/bug/linux-0e3ad548-c571-43d0-bf6b-00ed4771bd7a
> Signed-off-by: Arvind Yadav <arvind.yadav@intel.com>
> ---
>  drivers/gpu/drm/xe/xe_exec_queue.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_exec_queue.c b/drivers/gpu/drm/xe/xe_exec_queue.c
> index 7ade915c59a8..39d99d6d418c 100644
> --- a/drivers/gpu/drm/xe/xe_exec_queue.c
> +++ b/drivers/gpu/drm/xe/xe_exec_queue.c
> @@ -1471,8 +1471,14 @@ int xe_exec_queue_create_ioctl(struct drm_device *dev, void *data,
>  
>  	/* user id alloc must always be last in ioctl to prevent UAF */
>  	err = xa_alloc(&xef->exec_queue.xa, &id, q, xa_limit_32b, GFP_KERNEL);

What about moving the xa_alloc above setting 'q->xef' and calling
xe_vm_add_exec_queue?

Matt

> -	if (err)
> +	if (err) {
> +		/*
> +		 * q->xef is already set, so xe_exec_queue_fini() will
> +		 * decrement pending_removal even without an xarray entry.
> +		 */
> +		atomic_inc(&xef->exec_queue.pending_removal);
>  		goto del_hw_engine_group;
> +	}
>  
>  	args->exec_queue_id = id;
>  
> -- 
> 2.43.0
>