[RFC v2 6/9] drm/xe/bo: Prevent mmap of purged buffer objects

[Arvind Yadav <arvind.yadav@intel.com>]

Fail DRM_IOCTL_XE_GEM_MMAP_OFFSET with -EINVAL when called on purged
buffer objects to provide early error detection instead of allowing
deferred SIGBUS on memory access.

Problem:
  The mmap offset ioctl (DRM_IOCTL_XE_GEM_MMAP_OFFSET) returns a file
  offset that userspace can pass to mmap() to map GPU memory into its
  address space. For purged BOs, the backing store has been freed, but
  the VMA node offset remains valid. Without this check:

  1. Userspace successfully gets mmap offset for purged BO
  2. mmap() succeeds (VMA is created but has no backing pages)
  3. Any memory access triggers CPU page fault
  4. xe_bo_cpu_fault() detects purged state and returns VM_FAULT_SIGBUS

v2:
  - Fix reference counting: use drm_gem_object_put() instead of xe_bo_put()
    to properly balance drm_gem_object_lookup() (review feedback).
  - Added xe_bo_is_purged(bo) instead of atomic_read.

Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
Signed-off-by: Arvind Yadav <arvind.yadav@intel.com>
---
 drivers/gpu/drm/xe/xe_bo.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c
index 7f5bcf114ed4..dbbfb58ac657 100644
--- a/drivers/gpu/drm/xe/xe_bo.c
+++ b/drivers/gpu/drm/xe/xe_bo.c
@@ -3346,6 +3346,7 @@ int xe_gem_mmap_offset_ioctl(struct drm_device *dev, void *data,
 	struct xe_device *xe = to_xe_device(dev);
 	struct drm_xe_gem_mmap_offset *args = data;
 	struct drm_gem_object *gem_obj;
+	struct xe_bo *bo;
 
 	if (XE_IOCTL_DBG(xe, args->extensions) ||
 	    XE_IOCTL_DBG(xe, args->reserved[0] || args->reserved[1]))
@@ -3375,6 +3376,16 @@ int xe_gem_mmap_offset_ioctl(struct drm_device *dev, void *data,
 	if (XE_IOCTL_DBG(xe, !gem_obj))
 		return -ENOENT;
 
+	bo = gem_to_xe_bo(gem_obj);
+
+	/*
+	 * Reject mmap offset requests for purged BOs.
+	 */
+	if (xe_bo_is_purged(bo)) {
+		drm_gem_object_put(gem_obj);
+		return -EINVAL;
+	}
+
 	/* The mmap offset was set up at BO allocation time. */
 	args->offset = drm_vma_node_offset_addr(&gem_obj->vma_node);
 
-- 
2.43.0