Re: [PATCH v2 1/2] PCI/VGA: fix inverted vga_tryget() return check in vga_arb_write()

[sashiko-bot@kernel.org]

> In vga_arb_write(), the "trylock" command handler calls
> vga_tryget(pdev, io_state) and checks:
> 
>   if (vga_tryget(pdev, io_state)) {
>       /* Update the client's locks lists... */
> 
> However, vga_tryget() returns 0 on success and a negative errno (-EBUSY)
> when the VGA resources are already locked. Because the check tests for a
> non-zero return value, a successful vga_tryget() skips incrementing
> priv->cards[i].io_cnt / mem_cnt and skips reporting success, leaking the
> acquired VGA lock, whereas a failed vga_tryget() (-EBUSY) erroneously
> records the lock in priv->cards[i] so a subsequent "unlock" or file
> release decrements the lock count without holding the lock.
> 
> Check if (vga_tryget(pdev, io_state) == 0) in vga_arb_write().
> 
> Tested in QEMU against Linux 7.3.0-rc3 by opening /dev/vga_arbiter and
> writing "trylock io+mem" followed by closing the file descriptor. On the
> unfixed kernel, write("trylock io+mem") acquires the VGA lock
> (locks=io+mem(1:1)) but takes the error branch and returns -EBUSY (-16)
> without recording the lock in priv->cards[], permanently leaking the
> lock on close(); with this patch applied, write("trylock io+mem")
> succeeds (ret = 14) and close() cleanly releases the lock
> (locks=none(0:0)).
> 
> Fixes: deb2d2ecd43d ("PCI/GPU: implement VGA arbitration on Linux")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260921052702.1725696-1-benquike@gmail.com?part=1