Re: [PATCH v5 1/4] drm/xe/xe_migrate: Fix page tracking in access_memory

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] drm/xe: DMA mapping leak due to unsafe 0 address check
--

commit fb4208eca07c762dce441a27786ec36c6738057d
Author: Christoph Manszewski <c.manszewski@gmail.com>

drm/xe/xe_migrate: Fix page tracking in access_memory

xe_migrate_access_memory() advances the pagemap cursor based on the current
page in the CPU buffer. Include the initial page offset when recalculating
current_page so subsequent iterations continue to index the mapped pages
correctly.

> diff --git a/drivers/gpu/drm/xe/xe_migrate.c b/drivers/gpu/drm/xe/xe_migrate.c
> index fffb3eb6c76eb..3711d4542ad3d 100644
> --- a/drivers/gpu/drm/xe/xe_migrate.c
> +++ b/drivers/gpu/drm/xe/xe_migrate.c
> @@ -2563,7 +2563,7 @@ int xe_migrate_access_memory(struct xe_migrate *m, struct xe_bo *bo,
>  
>  		buf += current_bytes;
>  		offset += current_bytes;
> -		current_page = (int)(buf - orig_buf) / PAGE_SIZE;
> +		current_page = (int)(buf - orig_buf + page_offset) / PAGE_SIZE;

[Severity: High]
Does this code leak DMA mappings when the DMA subsystem returns 0 as a valid
DMA address?

In the out_err block of xe_migrate_access_memory() in
drivers/gpu/drm/xe/xe_migrate.c, we unconditionally call
xe_migrate_dma_unmap():

out_err:
	xe_migrate_dma_unmap(xe, pagemap_addr, len + page_offset, write);

However, if xe_migrate_dma_unmap() encounters an IOVA of 0, it stops unmapping
early:

	if (!pagemap_addr[i].addr)
		break;

Since 0 is explicitly allowed as a valid DMA address by the DMA API (errors
are handled via dma_mapping_error()), this early break can cause the unmap
loop to terminate incorrectly. This would permanently leak the mapping for 0
and all subsequent valid mapped pages in the array. Can this eventually
exhaust IOMMU or DMA space?

>  		bytes_left -= current_bytes;
>  		if (bytes_left)
>  			xe_res_next(&cursor, current_bytes);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261014142706.598490-1-jan.maslak@intel.com?part=1