Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
New issues: - [Low] The patch introduces a syntax error `rturn copied;` instead of `return copied;`. Pre-existing issues: - [High] Memory leak of migration packets across aborted or repeated SAVE operations. -- --- Patch [1]: [PATCH] drm/xe/pf: clear pending packet on header init failure --- commit c2701f46b2a82f4a8b22c425cd68c28c08222f7f Author: Guangshuo Li <[email protected]> drm/xe/pf: clear pending packet on header init failure This commit drops the pending packet when header initialization fails after the header has been fully consumed. This prevents a potential NULL pointer dereference on subsequent writes. > diff --git a/drivers/gpu/drm/xe/xe_sriov_packet.c > b/drivers/gpu/drm/xe/xe_sriov_packet.c > --- a/drivers/gpu/drm/xe/xe_sriov_packet.c > +++ b/drivers/gpu/drm/xe/xe_sriov_packet.c [ ... ] > @@ -332,11 +333,21 @@ ssize_t xe_sriov_packet_write_single(struct xe_device > *xe, unsigned int vfid, > - if ((*data)->hdr_remaining) > + writing_hdr = (*data)->hdr_remaining; > + if (writing_hdr) > copied = pkt_hdr_write(*data, buf, len); > else > copied = pkt_data_write(*data, buf, len); > > + if (copied < 0) { > + if (writing_hdr && !(*data)->hdr_remaining) { > + kfree(*data); > + *data = NULL; > + } > + > + rturn copied; [Severity: Low] There is a typo here (rturn instead of return). > + } > + > if ((*data)->hdr_remaining == 0 && (*data)->remaining == 0) { > ret = xe_sriov_pf_migration_restore_produce(xe, vfid, *data); [Severity: High] This is a pre-existing issue, but is it possible to leak migration packets across aborted or repeated save operations? If userspace initiates a VF migration save operation, aborts it without reading all packets, and then triggers a new save, will the pointers be overwritten without freeing the previously allocated packets? drivers/gpu/drm/xe/xe_sriov_packet.c:pf_descriptor_init() { ... *desc = data; ... } drivers/gpu/drm/xe/xe_sriov_packet.c:pf_trailer_init() { ... *trailer = data; ... } drivers/gpu/drm/xe/xe_sriov_packet.c:pf_pending_init() { ... *data = NULL; ... } -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
