Merge tag 'drm-xe-next-fixes-2025-11-21' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next

Driver Changes:
- A couple of SR-IOV fixes (Michal Winiarski)
- Fix a potential UAF (Sanjay)

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Thomas Hellstrom <thomas.hellstrom@linux.intel.com>
Link: https://patch.msgid.link/aSA08EW9JMU3LkIu@fedora

Author: airlied

drivers/gpu/drm/xe/xe_gt_sriov_pf_migration.c

@@ -571,6 +571,10 @@ static int pf_save_vram_chunk(struct xe_gt *gt, unsigned int vfid,
 	fence = __pf_save_restore_vram(gt, vfid,
 				       src_vram, src_vram_offset,
 				       data->bo, 0, size, true);
+	if (IS_ERR(fence)) {
+		ret = PTR_ERR(fence);
+		goto fail;
+	}
 
 	ret = dma_fence_wait_timeout(fence, false, PF_VRAM_SAVE_RESTORE_TIMEOUT);
 	dma_fence_put(fence);
@@ -654,13 +658,20 @@ static int pf_restore_vf_vram_mig_data(struct xe_gt *gt, unsigned int vfid,
 
 	fence = __pf_save_restore_vram(gt, vfid, vram, data->hdr.offset,
 				       data->bo, 0, data->hdr.size, false);
+	if (IS_ERR(fence)) {
+		ret = PTR_ERR(fence);
+		goto err;
+	}
+
 	ret = dma_fence_wait_timeout(fence, false, PF_VRAM_SAVE_RESTORE_TIMEOUT);
 	dma_fence_put(fence);
 	if (!ret) {
 		ret = -ETIME;
 		goto err;
 	}
 
+	xe_bo_put(vram);
+
 	return 0;
 err:
 	xe_bo_put(vram);

drivers/gpu/drm/xe/xe_oa.c

@@ -2403,11 +2403,13 @@ int xe_oa_add_config_ioctl(struct drm_device *dev, u64 data, struct drm_file *fi
 		goto sysfs_err;
 	}
 
-	mutex_unlock(&oa->metrics_lock);
+	id = oa_config->id;
+
+	drm_dbg(&oa->xe->drm, "Added config %s id=%i\n", oa_config->uuid, id);
 
-	drm_dbg(&oa->xe->drm, "Added config %s id=%i\n", oa_config->uuid, oa_config->id);
+	mutex_unlock(&oa->metrics_lock);
 
-	return oa_config->id;
+	return id;
 
 sysfs_err:
 	mutex_unlock(&oa->metrics_lock);

drivers/gpu/drm/xe/xe_sriov_pf_migration.c

@@ -148,8 +148,6 @@ pf_migration_consume(struct xe_device *xe, unsigned int vfid)
  * Return: Pointer to &xe_sriov_packet on success,
  *	   NULL if ring is empty and no more migration data is expected,
  *	   ERR_PTR value in case of error.
- *
- * Return: 0 on success or a negative error code on failure.
  */
 struct xe_sriov_packet *
 xe_sriov_pf_migration_save_consume(struct xe_device *xe, unsigned int vfid)