From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id E30B1C55167 for ; Thu, 30 Jul 2026 22:20:20 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 79B3910F0E7; Thu, 30 Jul 2026 22:20:20 +0000 (UTC) Authentication-Results: gabe.freedesktop.org; dkim=pass (2048-bit key; unprotected) header.d=intel.com header.i=@intel.com header.b="jyG2iu3i"; dkim-atps=neutral Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.11]) by gabe.freedesktop.org (Postfix) with ESMTPS id AC23A10F0E7; Thu, 30 Jul 2026 22:20:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1785450019; x=1816986019; h=date:message-id:from:to:cc:subject:in-reply-to: references:mime-version; bh=KyURgAO0iXKGnMmlHUqjHQn2SIg5SHEa+R3HRpxzAB8=; b=jyG2iu3ixItS15LjOUQMgYqQ/Iw33IH6PImp87PAPSW8GT4JlaDXVBaB stH34c9GmyLhsZhhAQIU8bwMZvK7po1+Kj0f3fnR+lOlNFdRRBrV7TtEU dM4rNy2FYtY9hGp1srmCci/1vJnFhM6bK9hFlNFuNdcLoxTI3QAbl6rMK QUelEwBom4AGezOnnWMlbnPmlpAQ60pZ3u0TcCKFDXSf3fedun2QjT7OJ z6I6JV3hnMyJvrJIi/L/OXal2YG2NdCoVtiwrYhP/IIUA/saSXiokc6Aq w3gQQirXMJl2IXTGxWfeJvyxp7EPa4MNCKlnPRnE3uUQyzXW1RzHLAjrO g==; X-CSE-ConnectionGUID: FEW6qYv1SiOj+/ljs0UVCw== X-CSE-MsgGUID: kqx06CD+SWy9HSIpAt3p5g== X-IronPort-AV: E=McAfee;i="6800,10657,11860"; a="96665284" X-IronPort-AV: E=Sophos;i="6.25,195,1779174000"; d="scan'208";a="96665284" Received: from fmviesa009.fm.intel.com ([10.60.135.149]) by fmvoesa105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 30 Jul 2026 15:20:19 -0700 X-CSE-ConnectionGUID: 0b3kzplpRuWZtojK6qh0qQ== X-CSE-MsgGUID: UYakIgFRTPmRNszMya+6bw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.25,195,1779174000"; d="scan'208";a="254095012" Received: from mcapezzu-mobl1.amr.corp.intel.com (HELO adixit-MOBL3.intel.com) ([10.125.38.25]) by fmviesa009-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 30 Jul 2026 15:20:19 -0700 Date: Thu, 30 Jul 2026 15:20:18 -0700 Message-ID: <875x1wglwd.wl-ashutosh.dixit@intel.com> From: "Dixit, Ashutosh" To: Linmao Li Cc: Matthew Brost , Thomas =?ISO-8859-1?Q?Hellstr?= =?ISO-8859-1?Q?=F6m?= , Rodrigo Vivi , David Airlie , Simona Vetter , =?ISO-8859-1?Q?Jos=E9?= Roberto de Souza , "Umesh Nerlige Ramappa" ,, , Subject: Re: [PATCH] drm/xe/oa: Fix sync entry leak on OA config emit failure In-Reply-To: <20260715023332.391298-1-lilinmao@kylinos.cn> References: <20260715023332.391298-1-lilinmao@kylinos.cn> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI-EPG/1.14.7 (Harue) FLIM-LB/1.14.9 (=?ISO-8859-4?Q?Goj=F2?=) APEL-LB/10.8 EasyPG/1.0.0 Emacs/30.2 (x86_64-pc-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-BeenThere: intel-xe@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Intel Xe graphics driver List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: intel-xe-bounces@lists.freedesktop.org Sender: "Intel-xe" On Tue, 14 Jul 2026 19:33:32 -0700, Linmao Li wrote: > Hi Linmao, Sorry for the delay in responding to this patch. > xe_oa_emit_oa_config() releases the sync entries and the syncs array > only on its success path. When it fails before the point of no return > (fence allocation, config buffer allocation or batch submission), it > returns without touching stream->syncs. > > The stream open path handles such failures in the caller, but > xe_oa_config_locked() propagates the error without any cleanup, so the > syncs array and the fence references held by the parsed entries are > leaked. The next config ioctl overwrites stream->syncs, making the > memory unreachable for good. > > Clean up the parsed syncs when xe_oa_emit_oa_config() fails, matching > the cleanup done by the stream open error path, and reset the stream > sync state so it does not point at freed entries. > > Fixes: 9920c8b88c5c ("drm/xe/oa: Add syncs support to OA config ioctl") > Signed-off-by: Linmao Li > --- > drivers/gpu/drm/xe/xe_oa.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/drivers/gpu/drm/xe/xe_oa.c b/drivers/gpu/drm/xe/xe_oa.c > index 2dce6a47202c..b1ce312ea97a 100644 > --- a/drivers/gpu/drm/xe/xe_oa.c > +++ b/drivers/gpu/drm/xe/xe_oa.c > @@ -1594,6 +1594,12 @@ static long xe_oa_config_locked(struct xe_oa_stream *stream, u64 arg) > config = xchg(&stream->oa_config, config); > drm_dbg(&stream->oa->xe->drm, "changed to oa config uuid=%s\n", > stream->oa_config->uuid); > + } else { > + while (param.num_syncs--) > + xe_sync_entry_cleanup(¶m.syncs[param.num_syncs]); > + kfree(param.syncs); > + stream->num_syncs = 0; > + stream->syncs = NULL; Yes this looks correct to me. Except that we don't need the two lines above. Can you please resend a v2 deleting the above two lines. Thanks for the patch, Ashutosh > } > > err_config_put: > -- > 2.25.1 >