All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] drm/xe: Account for exec queue cleanup after handle allocation fails
@ 2026-11-13  6:54 Arvind Yadav
  2026-11-13  7:02 ` ✗ CI.checkpatch: warning for " Patchwork
                   ` (4 more replies)
  0 siblings, 5 replies; 7+ messages in thread
From: Arvind Yadav @ 2026-11-13  6:54 UTC (permalink / raw)
  To: intel-xe, dri-devel
  Cc: matthew.brost, himal.prasad.ghimiray, thomas.hellstrom,
	rodrigo.vivi, tejas.upadhyay

xe_exec_queue_create_ioctl() assigns q->xef before allocating the
userspace handle. If xa_alloc() fails, queue finalization decrements
pending_removal even though the queue was never removed from the
xarray and the counter was never incremented.

This can leave pending_removal negative and block fdinfo readers
waiting for it to reach zero.

Increment pending_removal before unwinding the failed allocation.
The existing finalization path balances the increment.

Fixes: 0fd4380c050d ("drm/xe: Wait on killed exec queues")
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: Tejas Upadhyay <tejas.upadhyay@intel.com>
Assisted-by: LLM
Closes: https://sashiko.dev/#/bug/linux-0e3ad548-c571-43d0-bf6b-00ed4771bd7a
Signed-off-by: Arvind Yadav <arvind.yadav@intel.com>
---
 drivers/gpu/drm/xe/xe_exec_queue.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/xe/xe_exec_queue.c b/drivers/gpu/drm/xe/xe_exec_queue.c
index 7ade915c59a8..39d99d6d418c 100644
--- a/drivers/gpu/drm/xe/xe_exec_queue.c
+++ b/drivers/gpu/drm/xe/xe_exec_queue.c
@@ -1471,8 +1471,14 @@ int xe_exec_queue_create_ioctl(struct drm_device *dev, void *data,
 
 	/* user id alloc must always be last in ioctl to prevent UAF */
 	err = xa_alloc(&xef->exec_queue.xa, &id, q, xa_limit_32b, GFP_KERNEL);
-	if (err)
+	if (err) {
+		/*
+		 * q->xef is already set, so xe_exec_queue_fini() will
+		 * decrement pending_removal even without an xarray entry.
+		 */
+		atomic_inc(&xef->exec_queue.pending_removal);
 		goto del_hw_engine_group;
+	}
 
 	args->exec_queue_id = id;
 
-- 
2.43.0


^ permalink raw reply related	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2026-11-14  8:26 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-11-13  6:54 [PATCH] drm/xe: Account for exec queue cleanup after handle allocation fails Arvind Yadav
2026-11-13  7:02 ` ✗ CI.checkpatch: warning for " Patchwork
2026-11-13  7:04 ` ✓ CI.KUnit: success " Patchwork
2026-11-13  7:35 ` ✓ Xe.CI.BAT: " Patchwork
2026-11-13 18:13 ` ✓ Xe.CI.FULL: " Patchwork
2026-11-13 18:27 ` [PATCH] " Matthew Brost
2026-11-14  8:25   ` Yadav, Arvind

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.