[PATCH] drm/qxl: Fix a missing unreserve in an error path

[PATCH] drm/qxl: Fix a missing unreserve in an error path

[Bart Van Assche]

If qxl_bo_reserve() succeeds and ttm_bo_validate() fails,
qxl_update_area_ioctl() returns without calling qxl_bo_unreserve().
This leaves the buffer object reserved and causes later attempts to
reserve it to hang. Fix this by calling qxl_bo_unreserve() in that
error path.

This has been detected by the Clang thread-safety analyzer.
Compile-tested only.

Cc: Dave Airlie <airlied@redhat.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: virtualization@lists.linux.dev
Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/gpu/drm/qxl/qxl_ioctl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
index 591b026ceff9..40c1eca77b39 100644
--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
@@ -323,7 +323,7 @@ int qxl_update_area_ioctl(struct drm_device *dev, void *data, struct drm_file *f
 		qxl_ttm_placement_from_domain(qobj, qobj->type);
 		ret = ttm_bo_validate(&qobj->tbo, &qobj->placement, &ctx);
 		if (unlikely(ret))
-			goto out;
+			goto out2;
 	}
 
 	ret = qxl_bo_check_id(qdev, qobj);

Re: [PATCH] drm/qxl: Fix a missing unreserve in an error path

[sashiko-bot]

> If qxl_bo_reserve() succeeds and ttm_bo_validate() fails,
> qxl_update_area_ioctl() returns without calling qxl_bo_unreserve().
> This leaves the buffer object reserved and causes later attempts to
> reserve it to hang. Fix this by calling qxl_bo_unreserve() in that
> error path.
> 
> This has been detected by the Clang thread-safety analyzer.
> Compile-tested only.
> 
> Cc: Dave Airlie <airlied@redhat.com>
> Cc: Gerd Hoffmann <kraxel@redhat.com>
> Cc: virtualization@lists.linux.dev
> Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)")
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/4879712fc70d92a04de63eb81a673cd3d023af80.1793044836.git.bvanassche@acm.org?part=1