Re: [PATCH V21 06/15] drm/xe: Guard teardown paths against purged BOs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Unsafe access to purged pt_root vmap in xe_pt_clear() during VM teardown.
--

commit 93911d5c837da7fe0353a26b41f2f3b5ce75d05b
Author: Tejas Upadhyay <tejas.upadhyay@intel.com>

drm/xe: Guard teardown paths against purged BOs

VRAM page offlining can purge BOs that are still referenced by page
tables, exec queues, and DMA-buf exports. Add xe_bo_is_purged()
guards in the teardown paths to prevent unpinning or mapping an
already-purged BO.

> diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c
> index c255327669da5..b162753cebb70 100644
> --- a/drivers/gpu/drm/xe/xe_bo.c
> +++ b/drivers/gpu/drm/xe/xe_bo.c
> @@ -3267,6 +3267,9 @@ void xe_bo_unpin(struct xe_bo *bo)
>  	struct ttm_place *place = &bo->placements[0];
>  	struct xe_device *xe = xe_bo_device(bo);
>  
> +	if (xe_bo_is_purged(bo))
> +		return;
> +

[Severity: High]
Does xe_vm_close() also need to be guarded against purged BOs?

During VM teardown, if a VRAM page offline fault occurs on a userspace root
page table BO, the offliner purges the BO which unmaps its CPU vmap. Later,
when userspace closes the VM or the process exits, xe_vm_close()
unconditionally calls xe_pt_clear() on the root page table:

drivers/gpu/drm/xe/xe_vm.c:xe_vm_close() {
    ...
			for_each_tile(tile, xe, id)
				if (vm->pt_root[id])
					xe_pt_clear(xe, vm->pt_root[id]);
    ...
}

This passes the cleared vmap to xe_map_memset(), leading to a kernel panic
due to a NULL pointer dereference:

drivers/gpu/drm/xe/xe_pt.c:xe_pt_clear() {
	struct iosys_map *map = &pt->bo->vmap;

	xe_map_memset(xe, map, 0, 0, SZ_4K);
}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260903161553.528932-17-tejas.upadhyay@intel.com?part=6