From mboxrd@z Thu Jan 1 00:00:00 1970 From: Claude Code Review Bot To: dri-devel-reviews@example.com Subject: Claude review: drm/v3d: Reject invalid out_sync handles in submit ioctls Date: Thu, 04 Jun 2026 11:24:42 +1000 Message-ID: In-Reply-To: <20260603-v3d-sched-misc-fixes-v3-13-d7114bba55a0@igalia.com> References: <20260603-v3d-sched-misc-fixes-v3-0-d7114bba55a0@igalia.com> <20260603-v3d-sched-misc-fixes-v3-13-d7114bba55a0@igalia.com> X-Mailer: Claude Code Patch Reviewer Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit MIME-Version: 1.0 Patch Review Moves out_sync syncobj lookup from the post-processing stage (where it was silently skipped on failure) to before submission, failing with `-ENOENT` for invalid non-zero handles. Mirrors the in_sync validation from patch 6. The `v3d_put_multisync_post_deps()` is renamed to `v3d_submit_put_post_deps()` and now also handles the single `sync_out` cleanup. **Minor note**: When the `sync_out` lookup fails early (e.g., in `v3d_submit_cl_ioctl()`), the function returns `-ENOENT` *before* any jobs have been allocated, so there's no need to clean up jobs. However, the multisync extension might have been parsed already, allocating `se.out_syncs`. The early `return -ENOENT` skips the `v3d_submit_put_post_deps()` cleanup. Let me verify... Looking more carefully: the `sync_out` lookup is done after extension parsing but before job creation. If the lookup fails, `return -ENOENT` is used directly without going through the `fail` label. This leaks `se.out_syncs` if multi-sync extensions were partially parsed. However, the check `!(se.flags & DRM_V3D_EXT_ID_MULTI_SYNC)` ensures this code path only runs when multi-sync is NOT in use, so `se.out_syncs` would be NULL. This is correct. No issues. --- Generated by Claude Code Patch Reviewer