Re: [PATCH] drm/xe: Account for exec queue cleanup after handle allocation fails

["Yadav, Arvind" <arvind.yadav@intel.com>]

On 13-11-2026 23:57, Matthew Brost wrote:
> On Fri, Nov 13, 2026 at 12:24:36PM +0530, Arvind Yadav wrote:
>> xe_exec_queue_create_ioctl() assigns q->xef before allocating the
>> userspace handle. If xa_alloc() fails, queue finalization decrements
>> pending_removal even though the queue was never removed from the
>> xarray and the counter was never incremented.
>>
>> This can leave pending_removal negative and block fdinfo readers
>> waiting for it to reach zero.
>>
>> Increment pending_removal before unwinding the failed allocation.
>> The existing finalization path balances the increment.
>>
>> Fixes: 0fd4380c050d ("drm/xe: Wait on killed exec queues")
>> Cc: Matthew Brost <matthew.brost@intel.com>
>> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
>> Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
>> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
>> Cc: Tejas Upadhyay <tejas.upadhyay@intel.com>
>> Assisted-by: LLM
>> Closes: https://sashiko.dev/#/bug/linux-0e3ad548-c571-43d0-bf6b-00ed4771bd7a
>> Signed-off-by: Arvind Yadav <arvind.yadav@intel.com>
>> ---
>>   drivers/gpu/drm/xe/xe_exec_queue.c | 8 +++++++-
>>   1 file changed, 7 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/gpu/drm/xe/xe_exec_queue.c b/drivers/gpu/drm/xe/xe_exec_queue.c
>> index 7ade915c59a8..39d99d6d418c 100644
>> --- a/drivers/gpu/drm/xe/xe_exec_queue.c
>> +++ b/drivers/gpu/drm/xe/xe_exec_queue.c
>> @@ -1471,8 +1471,14 @@ int xe_exec_queue_create_ioctl(struct drm_device *dev, void *data,
>>   
>>   	/* user id alloc must always be last in ioctl to prevent UAF */
>>   	err = xa_alloc(&xef->exec_queue.xa, &id, q, xa_limit_32b, GFP_KERNEL);
> What about moving the xa_alloc above setting 'q->xef' and calling
> xe_vm_add_exec_queue?


My concern is that xa_alloc() makes q visible to other threads sharing 
the file. If a concurrent destroy occurs with a ID, q could be freed 
before we set q->xef or call xe_vm_add_exec_queue() and this will lead 
to a potential UAF.


Thanks,
Arvind

>
> Matt
>
>> -	if (err)
>> +	if (err) {
>> +		/*
>> +		 * q->xef is already set, so xe_exec_queue_fini() will
>> +		 * decrement pending_removal even without an xarray entry.
>> +		 */
>> +		atomic_inc(&xef->exec_queue.pending_removal);
>>   		goto del_hw_engine_group;
>> +	}
>>   
>>   	args->exec_queue_id = id;
>>   
>> -- 
>> 2.43.0
>>