Fix dma_resv_wait_timeout() return handling in rocket/panfrost ioctls

PATCH In review Gyeyoung Baek 5 participants 8 messages Apr 19 – May 7

Subsystems (6)

Stable branch DRM drivers DRM misc DRM compute accelerators drivers and framework +2 more subsystems

lore

Share & tools

lore

Gyeyoung Baek

author

2026-04-19 07:19 UTC #0 lore raw

cover Fix dma_resv_wait_timeout() return handling in rocket/panfrost ioctls

dma_resv_wait_timeout() returns a positive 'long' (remaining jiffies) on success, which is truncated to 'int`.
So userspace interpret that as an error.

Each patch explicitly sets ret to 0 on the
success path.

Gyeyoung Baek (2):
accel/rocket: Fix prep_bo ioctl leaking positive return from
dma_resv_wait_timeout()
drm/panfrost: Fix wait_bo ioctl leaking positive return from
dma_resv_wait_timeout()

 drivers/accel/rocket/rocket_gem.c       | 2 ++
 drivers/gpu/drm/panfrost/panfrost_drv.c | 2 ++
 2 files changed, 4 insertions(+)

Signature · 1 line

2.43.0

Gyeyoung Baek

author

2026-04-19 07:19 UTC #1 lore raw

PATCH 1/2 accel/rocket: Fix prep_bo ioctl leaking positive return from dma_resv_wait_timeout()

dma_resv_wait_timeout() returns a positive 'remaining jiffies' value on success, 0 on timeout, and -errno on failure.

rocket_ioctl_prep_bo() returns this 'long' result from an int-typed ioctl handler, so positive values reach userspace as bogus errors. Explicitly set ret to 0 on the success path.

Fixes 525ad89dd904 ("accel/rocket: Add IOCTLs for synchronizing memory accesses")

Cc [email protected]

Signed-off-by Gyeyoung Baek <[email protected]>

---
 drivers/accel/rocket/rocket_gem.c | 2 ++
 1 file changed, 2 insertions(+)

drivers/accel/rocket/rocket_gem.c +2 -0

index b6a385d2e..c80847192 100644
@@ -145,6 +145,8 @@ int rocket_ioctl_prep_bo(struct drm_device *dev, void *data, struct drm_file *fi
 	ret = dma_resv_wait_timeout(gem_obj->resv, DMA_RESV_USAGE_WRITE, true, timeout);
 	if (!ret)
 		ret = timeout ? -ETIMEDOUT : -EBUSY;
+	else if (ret > 0)
+		ret = 0;
 
 	shmem_obj = &to_rocket_bo(gem_obj)->base;

Signature · 1 line

2.43.0

Gyeyoung Baek

author

2026-04-19 07:20 UTC #3 lore raw

PATCH 2/2 drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout()

In reply to Gyeyoung Baek

dma_resv_wait_timeout() returns a positive 'remaining jiffies' value on success, 0 on timeout, and -errno on failure.

panfrost_ioctl_wait_bo() returns this 'long' result from an int-typed ioctl handler, so positive values reach userspace as bogus errors. Explicitly set ret to 0 on the success path.

Fixes f3ba91228e8e ("drm/panfrost: Add initial panfrost driver")

Cc [email protected]

Signed-off-by Gyeyoung Baek <[email protected]>

---
 drivers/gpu/drm/panfrost/panfrost_drv.c | 2 ++
 1 file changed, 2 insertions(+)

drivers/gpu/drm/panfrost/panfrost_drv.c +2 -0

index 3d0bdba2a..784e36d72 100644
@@ -390,6 +390,8 @@ panfrost_ioctl_wait_bo(struct drm_device *dev, void *data,
 				    true, timeout);
 	if (!ret)
 		ret = timeout ? -ETIMEDOUT : -EBUSY;
+	else if (ret > 0)
+		ret = 0;
 
 	drm_gem_object_put(gem_obj);

Signature · 1 line

2.43.0

Boris Brezillon

maintainer Reviewed-by on v1 2/2

2026-04-20 08:08 UTC #4 lore raw

Re: [PATCH v1 2/2] drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout()

Quoted 10 lines · On Sun, 19 Apr 2026 16:17:16 +0900 Gyeyoung Baek <[email protected]> wrote:

dma_resv_wait_timeout() returns a positive 'remaining jiffies' value on success, 0 on timeout, and -errno on failure.
panfrost_ioctl_wait_bo() returns this 'long' result from an int-typed ioctl handler, so positive values reach userspace as bogus errors. Explicitly set ret to 0 on the success path.
Fixes f3ba91228e8e ("drm/panfrost: Add initial panfrost driver")
Cc [email protected]
Signed-off-by Gyeyoung Baek <[email protected]>

Reviewed-by Boris Brezillon <[email protected]>

Quoted 17 lines

---
 drivers/gpu/drm/panfrost/panfrost_drv.c | 2 ++
 1 file changed, 2 insertions(+)

drivers/gpu/drm/panfrost/panfrost_drv.c +2 -0

index 3d0bdba2a..784e36d72 100644
@@ -390,6 +390,8 @@ panfrost_ioctl_wait_bo(struct drm_device *dev, void *data,
 				    true, timeout);
 	if (!ret)
 		ret = timeout ? -ETIMEDOUT : -EBUSY;
+	else if (ret > 0)
+		ret = 0;
 
 	drm_gem_object_put(gem_obj);

Steven Price

maintainer Reviewed-by on v1 2/2

2026-04-20 11:18 UTC #5 lore raw

Re: [PATCH v1 2/2] drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout()

In reply to Gyeyoung Baek

Quoted 10 lines · Gyeyoung Baek

dma_resv_wait_timeout() returns a positive 'remaining jiffies' value on success, 0 on timeout, and -errno on failure.
panfrost_ioctl_wait_bo() returns this 'long' result from an int-typed ioctl handler, so positive values reach userspace as bogus errors. Explicitly set ret to 0 on the success path.
Fixes f3ba91228e8e ("drm/panfrost: Add initial panfrost driver")
Cc [email protected]
Signed-off-by Gyeyoung Baek <[email protected]>

Reviewed-by Steven Price <[email protected]>

Quoted 17 lines

---
 drivers/gpu/drm/panfrost/panfrost_drv.c | 2 ++
 1 file changed, 2 insertions(+)

drivers/gpu/drm/panfrost/panfrost_drv.c +2 -0

index 3d0bdba2a..784e36d72 100644
@@ -390,6 +390,8 @@ panfrost_ioctl_wait_bo(struct drm_device *dev, void *data,
 				    true, timeout);
 	if (!ret)
 		ret = timeout ? -ETIMEDOUT : -EBUSY;
+	else if (ret > 0)
+		ret = 0;
 
 	drm_gem_object_put(gem_obj);

Tomeu Vizoso

maintainer Reviewed-by on v1 1/2

2026-04-20 14:13 UTC #2 lore raw

Re: [PATCH v1 1/2] accel/rocket: Fix prep_bo ioctl leaking positive return from dma_resv_wait_timeout()

In reply to Gyeyoung Baek

Quoted 11 lines · Gyeyoung Baek

dma_resv_wait_timeout() returns a positive 'remaining jiffies' value on success, 0 on timeout, and -errno on failure.
rocket_ioctl_prep_bo() returns this 'long' result from an int-typed ioctl handler, so positive values reach userspace as bogus errors. Explicitly set ret to 0 on the success path.
Fixes 525ad89dd904 ("accel/rocket: Add IOCTLs for synchronizing memory accesses")
Cc [email protected]
Signed-off-by Gyeyoung Baek <[email protected]>

Reviewed-by Tomeu Vizoso <[email protected]>

Thanks!

Tomeu

Quoted 20 lines

---
 drivers/accel/rocket/rocket_gem.c | 2 ++
 1 file changed, 2 insertions(+)

drivers/accel/rocket/rocket_gem.c +2 -1

index b6a385d2e..c80847192 100644
@@ -145,6 +145,8 @@ int rocket_ioctl_prep_bo(struct drm_device *dev, void *data, struct drm_file *fi
        ret = dma_resv_wait_timeout(gem_obj->resv, DMA_RESV_USAGE_WRITE, true, timeout);
        if (!ret)
                ret = timeout ? -ETIMEDOUT : -EBUSY;
+       else if (ret > 0)
+               ret = 0;
 
        shmem_obj = &to_rocket_bo(gem_obj)->base;
 
--

2.43.0

Adrián Larumbe

maintainer Reviewed-by on v1 2/2

2026-04-21 20:38 UTC #6 lore raw

Re: [PATCH v1 2/2] drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout()

In reply to Gyeyoung Baek

Reviewed-by Adrián Larumbe <[email protected]>

Quoted 29 lines · Gyeyoung Baek

dma_resv_wait_timeout() returns a positive 'remaining jiffies' value on success, 0 on timeout, and -errno on failure.
panfrost_ioctl_wait_bo() returns this 'long' result from an int-typed ioctl handler, so positive values reach userspace as bogus errors. Explicitly set ret to 0 on the success path.
Fixes f3ba91228e8e ("drm/panfrost: Add initial panfrost driver")
Cc [email protected]
Signed-off-by Gyeyoung Baek <[email protected]>
---
 drivers/gpu/drm/panfrost/panfrost_drv.c | 2 ++
 1 file changed, 2 insertions(+)
drivers/gpu/drm/panfrost/panfrost_drv.c +2 -1
index 3d0bdba2a..784e36d72 100644
@@ -390,6 +390,8 @@ panfrost_ioctl_wait_bo(struct drm_device *dev, void *data,
 				    true, timeout);
 	if (!ret)
 		ret = timeout ? -ETIMEDOUT : -EBUSY;
+	else if (ret > 0)
+		ret = 0;
 
 	drm_gem_object_put(gem_obj);
 
--
2.43.0

Steven Price

maintainer

2026-05-07 14:00 UTC #7 lore raw

In reply to Gyeyoung Baek

Quoted 13 lines · Gyeyoung Baek

dma_resv_wait_timeout() returns a positive 'long' (remaining jiffies) on success, which is truncated to 'int`.
So userspace interpret that as an error.
Each patch explicitly sets ret to 0 on the
success path.
Gyeyoung Baek (2):
accel/rocket: Fix prep_bo ioctl leaking positive return from
dma_resv_wait_timeout()
drm/panfrost: Fix wait_bo ioctl leaking positive return from
dma_resv_wait_timeout()

Quoted 4 lines

 drivers/accel/rocket/rocket_gem.c       | 2 ++
 drivers/gpu/drm/panfrost/panfrost_drv.c | 2 ++
 2 files changed, 4 insertions(+)

Both patches pushed to drm-misc-fixes.

Thanks,
Steve