Re: [PATCH v5 6/8] drm/xe/mmio_gem: fix destroy flow

[Matthew Auld <matthew.auld@intel.com>]

On 08/09/2026 18:12, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> 
> Pre-existing issues:
> - [High] GFP_KERNEL allocation under dma_resv lock triggers lockdep splat and potential deadlock
> --
> 
> commit 6f195ca9ff5839faa94b4a50effe5cb10176e87b
> Author: Ilia Levi <ilia.levi@intel.com>
> Subject: drm/xe/mmio_gem: fix destroy flow
> 
> This commit fixes a use-after-free in the gem object destroy flow by
> introducing proper synchronization and refcounting. It uses the dma_resv lock
> to serialize the fault handler with the destroy operation and unmaps existing
> pages to cut off access to the real mmio after destruction.
> 
>> diff --git a/drivers/gpu/drm/xe/xe_mmio_gem.c b/drivers/gpu/drm/xe/xe_mmio_gem.c
>> index 970b1e2f49815..5ffe03d361902 100644
>> --- a/drivers/gpu/drm/xe/xe_mmio_gem.c
>> +++ b/drivers/gpu/drm/xe/xe_mmio_gem.c
> [ ... ]
>> @@ -176,10 +189,9 @@ static int alloc_dummy_page_if_needed(struct drm_gem_object *base)
>>   {
>>   	struct xe_mmio_gem *obj = to_xe_mmio_gem(base);
>>   
>> -	dma_resv_lock(base->resv, NULL);
>> +	dma_resv_assert_held(base->resv);
>>   	if (!obj->dummy_page)
>>   		obj->dummy_page = alloc_page(GFP_KERNEL | __GFP_ZERO);
> 
> [Severity: High]
> This isn't a bug introduced by this patch, but does this allocation context
> create a lockdep violation or potential deadlock?
> 
> The vma fault handler calls xe_mmio_gem_vm_fault, which takes the
> dma_resv_lock. If the device is unplugged, it eventually calls
> alloc_dummy_page_if_needed, executing alloc_page(GFP_KERNEL | __GFP_ZERO)
> while holding base->resv. Since dma_resv locks are taken by shrinkers during
> memory reclaim, holding it while doing a GFP_KERNEL allocation creates a
> circular dependency.

We are allowed to allocate under dma-resv. Loads of places do it. From 
shrinker side, it is trylock all the way down for dma-resv, at least for 
direct-reclaim.

> 
> This can be reached by any unprivileged userspace process that mmaps the mmio
> gem object and triggers a page fault while the device is in an unplugged
> state.
> 
>> -	dma_resv_unlock(base->resv);
>>   
>>   	return obj->dummy_page ? 0 : -ENOMEM;
>>   }
>