[PATCH 1/2] drm/xe/gsc: Fix double-free of managed BO in error path

[PATCH 1/2] drm/xe/gsc: Fix double-free of managed BO in error path

[Shuicheng Lin]

The error path in xe_gsc_init_post_hwconfig() explicitly frees a BO
allocated with xe_managed_bo_create_pin_map() via
xe_bo_unpin_map_no_vm(). Since the managed BO already has a devm
cleanup action registered, this causes a double-free when devm
unwinds during probe failure.

Remove the explicit free and let devm handle it, consistent with
all other xe_managed_bo_create_pin_map() callers.

Fixes: 2e5d47fe7839 ("drm/xe/uc: Use managed bo for HuC and GSC objects")
Cc: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
---
 drivers/gpu/drm/xe/xe_gsc.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/xe/xe_gsc.c b/drivers/gpu/drm/xe/xe_gsc.c
index 0d13e357fb43..aab59dc647fb 100644
--- a/drivers/gpu/drm/xe/xe_gsc.c
+++ b/drivers/gpu/drm/xe/xe_gsc.c
@@ -482,8 +482,7 @@ int xe_gsc_init_post_hwconfig(struct xe_gsc *gsc)
 				 EXEC_QUEUE_FLAG_PERMANENT, 0);
 	if (IS_ERR(q)) {
 		xe_gt_err(gt, "Failed to create queue for GSC submission\n");
-		err = PTR_ERR(q);
-		goto out_bo;
+		return PTR_ERR(q);
 	}
 
 	wq = alloc_ordered_workqueue("gsc-ordered-wq", 0);
@@ -506,8 +505,6 @@ int xe_gsc_init_post_hwconfig(struct xe_gsc *gsc)
 
 out_q:
 	xe_exec_queue_put(q);
-out_bo:
-	xe_bo_unpin_map_no_vm(bo);
 	return err;
 }
 
-- 
2.43.0

Re: [PATCH 1/2] drm/xe/gsc: Fix double-free of managed BO in error path

[Daniele Ceraolo Spurio]

On 4/27/2026 8:46 AM, Shuicheng Lin wrote:
> The error path in xe_gsc_init_post_hwconfig() explicitly frees a BO
> allocated with xe_managed_bo_create_pin_map() via
> xe_bo_unpin_map_no_vm(). Since the managed BO already has a devm
> cleanup action registered, this causes a double-free when devm
> unwinds during probe failure.
>
> Remove the explicit free and let devm handle it, consistent with
> all other xe_managed_bo_create_pin_map() callers.
>
> Fixes: 2e5d47fe7839 ("drm/xe/uc: Use managed bo for HuC and GSC objects")
> Cc: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
> Assisted-by: Claude:claude-opus-4.6
> Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>

Reviewed-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>

Daniele

> ---
>   drivers/gpu/drm/xe/xe_gsc.c | 5 +----
>   1 file changed, 1 insertion(+), 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/xe/xe_gsc.c b/drivers/gpu/drm/xe/xe_gsc.c
> index 0d13e357fb43..aab59dc647fb 100644
> --- a/drivers/gpu/drm/xe/xe_gsc.c
> +++ b/drivers/gpu/drm/xe/xe_gsc.c
> @@ -482,8 +482,7 @@ int xe_gsc_init_post_hwconfig(struct xe_gsc *gsc)
>   				 EXEC_QUEUE_FLAG_PERMANENT, 0);
>   	if (IS_ERR(q)) {
>   		xe_gt_err(gt, "Failed to create queue for GSC submission\n");
> -		err = PTR_ERR(q);
> -		goto out_bo;
> +		return PTR_ERR(q);
>   	}
>   
>   	wq = alloc_ordered_workqueue("gsc-ordered-wq", 0);
> @@ -506,8 +505,6 @@ int xe_gsc_init_post_hwconfig(struct xe_gsc *gsc)
>   
>   out_q:
>   	xe_exec_queue_put(q);
> -out_bo:
> -	xe_bo_unpin_map_no_vm(bo);
>   	return err;
>   }
>   

[PATCH 0/2] drm/xe: Fix double-free of managed BOs in error paths

[Shuicheng Lin]

Two callers of xe_managed_bo_create_pin_map() explicitly free the BO via
xe_bo_unpin_map_no_vm() in their error paths. Since the managed BO
already has a devm cleanup action registered, this causes a double-free
when devm unwinds during probe failure.

Remove the explicit frees and let devm handle cleanup, consistent with
all other xe_managed_bo_create_pin_map() callers.

Shuicheng Lin (2):
  drm/xe/gsc: Fix double-free of managed BO in error path
  drm/xe/hw_engine: Fix double-free of managed BO in error path

 drivers/gpu/drm/xe/xe_gsc.c       | 5 +----
 drivers/gpu/drm/xe/xe_hw_engine.c | 4 +---
 2 files changed, 2 insertions(+), 7 deletions(-)

-- 
2.43.0

[PATCH 1/2] drm/xe/gsc: Fix double-free of managed BO in error path

[Shuicheng Lin]

The error path in xe_gsc_init_post_hwconfig() explicitly frees a BO
allocated with xe_managed_bo_create_pin_map() via
xe_bo_unpin_map_no_vm(). Since the managed BO already has a devm
cleanup action registered, this causes a double-free when devm
unwinds during probe failure.

Remove the explicit free and let devm handle it, consistent with
all other xe_managed_bo_create_pin_map() callers.

Fixes: 2e5d47fe7839 ("drm/xe/uc: Use managed bo for HuC and GSC objects")
Cc: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
---
 drivers/gpu/drm/xe/xe_gsc.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/xe/xe_gsc.c b/drivers/gpu/drm/xe/xe_gsc.c
index 0d13e357fb43..aab59dc647fb 100644
--- a/drivers/gpu/drm/xe/xe_gsc.c
+++ b/drivers/gpu/drm/xe/xe_gsc.c
@@ -482,8 +482,7 @@ int xe_gsc_init_post_hwconfig(struct xe_gsc *gsc)
 				 EXEC_QUEUE_FLAG_PERMANENT, 0);
 	if (IS_ERR(q)) {
 		xe_gt_err(gt, "Failed to create queue for GSC submission\n");
-		err = PTR_ERR(q);
-		goto out_bo;
+		return PTR_ERR(q);
 	}
 
 	wq = alloc_ordered_workqueue("gsc-ordered-wq", 0);
@@ -506,8 +505,6 @@ int xe_gsc_init_post_hwconfig(struct xe_gsc *gsc)
 
 out_q:
 	xe_exec_queue_put(q);
-out_bo:
-	xe_bo_unpin_map_no_vm(bo);
 	return err;
 }
 
-- 
2.43.0