drm/xe: Fix possible exec queue leak in exec IOCTL

In a couple of places after an exec queue is looked up the exec IOCTL
returns on input errors without dropping the exec queue ref. Fix this
ensuring the exec queue ref is dropped on input error.

Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Cc: <stable@vger.kernel.org>
Signed-off-by: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: Tejas Upadhyay <tejas.upadhyay@intel.com>
Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20241105043524.4062774-2-matthew.brost@intel.com

diff --git a/drivers/gpu/drm/xe/xe_exec.c b/drivers/gpu/drm/xe/xe_exec.c
index f23ac1e..6de12f9 100644 (file)
--- a/drivers/gpu/drm/xe/xe_exec.c
+++ b/drivers/gpu/drm/xe/xe_exec.c
@@ -132,12 +132,16 @@ int xe_exec_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
        if (XE_IOCTL_DBG(xe, !q))
                return -ENOENT;
 
-       if (XE_IOCTL_DBG(xe, q->flags & EXEC_QUEUE_FLAG_VM))
-               return -EINVAL;
+       if (XE_IOCTL_DBG(xe, q->flags & EXEC_QUEUE_FLAG_VM)) {
+               err = -EINVAL;
+               goto err_exec_queue;
+       }
 
        if (XE_IOCTL_DBG(xe, args->num_batch_buffer &&
-                        q->width != args->num_batch_buffer))
-               return -EINVAL;
+                        q->width != args->num_batch_buffer)) {
+               err = -EINVAL;
+               goto err_exec_queue;
+       }
 
        if (XE_IOCTL_DBG(xe, q->ops->reset_status(q))) {
                err = -ECANCELED;