[PATCH 0/2] drm/amdgpu/userq: fix a leaked fence driver and an unlocked doorbell walk

[Junrui Luo via B4 Relay <devnull+moonafterrain.outlook.com@kernel.org>]

Patch 1 cancels the fences still linked on a queue's fence driver when the
queue goes away.  Each of them holds a reference on the driver, so its
refcount never reaches zero and the seq64 slot stays allocated for the
lifetime of the device.

Patch 2 holds xa_lock_irqsave() across the doorbell xarray walk in
mes_userq_detect_and_reset().  That xarray is device wide, so the walk
dereferences queues owned by other drm_files, and nothing keeps them alive
for its duration.

Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
---
Junrui Luo (2):
      drm/amdgpu/userq: cancel linked fences on fence driver free
      drm/amdgpu/userq: hold the doorbell xa lock during hang reset

 drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c | 71 ++++++++++++++++---------
 drivers/gpu/drm/amd/amdgpu/mes_userqueue.c      | 13 ++++-
 2 files changed, 57 insertions(+), 27 deletions(-)
---
base-commit: f5bbbfec59b4e2fb7520a91de3df8a6174325d6a
change-id: 20260816-amdgpu-fixes-18d9598a85ca

Best regards,
-- 
Junrui Luo <moonafterrain@outlook.com>