drm/xe: Fix possible exec queue leak in exec IOCTL

In a couple of places after an exec queue is looked up the exec IOCTL
returns on input errors without dropping the exec queue ref. Fix this
ensuring the exec queue ref is dropped on input error.

Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Cc: <stable@vger.kernel.org>
Signed-off-by: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: Tejas Upadhyay <tejas.upadhyay@intel.com>
Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20241105043524.4062774-2-matthew.brost@intel.com

diff --git a/drivers/gpu/drm/xe/xe_exec.c b/drivers/gpu/drm/xe/xe_exec.c
index f23ac1e2ed88c4026aced9c737ebd9dbd8165924..6de12f91b865b869b2d81e21b1aa273b93ed1439 100644 (file)
--- a/drivers/gpu/drm/xe/xe_exec.c
+++ b/drivers/gpu/drm/xe/xe_exec.c
@@ -132,12 +132,16 @@ int xe_exec_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
        if (XE_IOCTL_DBG(xe, !q))
                return -ENOENT;
 
-       if (XE_IOCTL_DBG(xe, q->flags & EXEC_QUEUE_FLAG_VM))
-               return -EINVAL;
+       if (XE_IOCTL_DBG(xe, q->flags & EXEC_QUEUE_FLAG_VM)) {
+               err = -EINVAL;
+               goto err_exec_queue;
+       }
 
        if (XE_IOCTL_DBG(xe, args->num_batch_buffer &&
-                        q->width != args->num_batch_buffer))
-               return -EINVAL;
+                        q->width != args->num_batch_buffer)) {
+               err = -EINVAL;
+               goto err_exec_queue;
+       }
 
        if (XE_IOCTL_DBG(xe, q->ops->reset_status(q))) {
                err = -ECANCELED;