[PATCH 0/2] drm/amdgpu: fix error handling bugs in amdgpu_userq_create()

[PATCH 0/2] drm/amdgpu: fix error handling bugs in amdgpu_userq_create()

[Junrui Luo]

Commit f18719ef4bb7 ("drm/amdgpu: Convert amdgpu userqueue management
from IDR to XArray") introduced a global XArray userq_doorbell_xa for
device-wide queue tracking, but the error paths in amdgpu_userq_create()
were not fully updated to clean up entries from it.

- Patch 1 fixes a use-after-free: when xa_alloc() or
amdgpu_userq_map_helper() fails, the queue is freed but its pointer
remains in userq_doorbell_xa. Any subsequent xa_for_each() iteration
(suspend, resume, GPU reset) dereferences the freed pointer.

- Patch 2 fixes a resource leak: when xa_store_irq() fails, the error
path calls kfree() without first releasing resources from the preceding
successful mqd_create() and fence_driver_alloc().

Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
---
Junrui Luo (2):
      drm/amdgpu: fix use-after-free in amdgpu_userq_create() error paths
      drm/amdgpu: fix resource leak in amdgpu_userq_create() xa_store_irq error path

 drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 4 ++++
 1 file changed, 4 insertions(+)
---
base-commit: 7aaa8047eafd0bd628065b15757d9b48c5f9c07d
change-id: 20260411-fixes-30893f27c5aa

Best regards,
-- 
Junrui Luo <moonafterrain@outlook.com>

Claude review: drm/amdgpu: fix error handling bugs in amdgpu_userq_create()

[Claude Code Review Bot]

Overall Series Review

Subject: drm/amdgpu: fix error handling bugs in amdgpu_userq_create()
Author: Junrui Luo <moonafterrain@outlook.com>
Patches: 1
Reviewed: 2026-04-12T09:10:36.963748

---

This is a 2-patch series from Junrui Luo fixing error handling bugs in `amdgpu_userq_create()` related to the XArray-based queue tracking introduced by commit f18719ef4bb7. The series claims to fix a use-after-free and a resource leak in error paths.

**Critical issue: The mbox file only contains the cover letter (patch 0/2).** The actual patches (1/2 and 2/2) were not captured in the filtered mbox, so this review is based on the cover letter descriptions and analysis of the current source tree.

**The patches could not be applied**, and analyzing the current drm-next code at `drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c`, **both issues described in the cover letter appear to already be fixed** in the current tree. The error paths in `amdgpu_userq_create()` on drm-next already properly handle cleanup of both the XArray entries and the MQD/fence resources. This strongly suggests these fixes (or equivalent ones) have already been merged.

---

---
Generated by Claude Code Patch Reviewer