[PATCH v5 2/2] drm/xe: Keep imported sg BOs off LRU until dma-buf attach succeeds

[Nitin Gote <nitin.r.gote@intel.com>]

Imported dma-buf BOs are created as ttm_bo_type_sg with bo->base.resv
pointing at the exporter's resv. They are initialized with system
placement, which allocates a ttm_resource and makes the BO visible to
TTM LRU walkers before dma_buf_dynamic_attach() has succeeded.

If attach fails, xe holds no dma-buf reference, but an LRU walker may
already have referenced the BO and locked bo->base.resv (the exporter
resv). If the exporter is then freed, this is a use-after-free.

Use an empty initial placement for imported sg BOs so bo->resource
stays NULL and the BO is never added to an LRU before attach succeeds.

As a result sg BOs now start without a resource, so their first move
has old_mem == NULL. Check ttm_bo_type_sg before the creation path in
xe_bo_move() so imports always use the dma-buf move path, and handle
resource-less sg BOs in xe_evict_flags() before dereferencing
tbo->resource.

Cc: Thomas Hellstrom <thomas.hellstrom@linux.intel.com>
Cc: Christian Koenig <christian.koenig@amd.com>
Cc: Matthew Auld <matthew.auld@intel.com>
Assisted-by: GitHub_Copilot:claude-sonnet-4.6
Signed-off-by: Nitin Gote <nitin.r.gote@intel.com>
---
 drivers/gpu/drm/xe/xe_bo.c | 53 ++++++++++++++++++++++++++++----------
 1 file changed, 39 insertions(+), 14 deletions(-)

diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c
index 85e6d9a0f575..050de0f13232 100644
--- a/drivers/gpu/drm/xe/xe_bo.c
+++ b/drivers/gpu/drm/xe/xe_bo.c
@@ -63,6 +63,12 @@ static struct ttm_placement sys_placement = {
 
 static struct ttm_placement purge_placement;
 
+/* Initial placement: keeps imported sg BOs resource-less (off the LRU)
+ * until dma_buf_dynamic_attach() succeeds so they are not visible to LRU
+ * walkers while bo->base.resv still points at the exporter.
+ */
+static struct ttm_placement sg_init_placement;
+
 static const struct ttm_place tt_placement_flags[] = {
 	{
 		.fpfn = 0,
@@ -342,9 +348,14 @@ static void xe_evict_flags(struct ttm_buffer_object *tbo,
 	}
 
 	/*
-	 * For xe, sg bos that are evicted to system just triggers a
-	 * rebind of the sg list upon subsequent validation to XE_PL_TT.
+	 * sg BOs (dma-buf imports) evict to system and may have no
+	 * resource yet, so handle them before dereferencing tbo->resource.
 	 */
+	if (tbo->type == ttm_bo_type_sg) {
+		*placement = sys_placement;
+		return;
+	}
+
 	switch (tbo->resource->mem_type) {
 	case XE_PL_VRAM0:
 	case XE_PL_VRAM1:
@@ -980,6 +991,22 @@ static int xe_bo_move(struct ttm_buffer_object *ttm_bo, bool evict,
 		return 0;
 	}
 
+	/*
+	 * sg BOs (dma-buf imports) must always be moved via the dmabuf path,
+	 * regardless of whether they have an existing resource. This check must
+	 * come before the creation-path check below: sg BOs start with no
+	 * resource (sg_init_placement), so their first move to XE_PL_TT has
+	 * old_mem == NULL, which would otherwise incorrectly trigger the
+	 * creation path and call xe_tt_map_sg() instead of xe_bo_move_dmabuf().
+	 */
+	if (ttm_bo->type == ttm_bo_type_sg) {
+		if (new_mem->mem_type == XE_PL_SYSTEM)
+			ret = xe_bo_move_notify(bo, ctx);
+		if (!ret)
+			ret = xe_bo_move_dmabuf(ttm_bo, new_mem);
+		return ret;
+	}
+
 	/* Bo creation path, moving to system or TT. */
 	if ((!old_mem && ttm) && !handle_system_ccs) {
 		if (new_mem->mem_type == XE_PL_TT)
@@ -989,14 +1016,6 @@ static int xe_bo_move(struct ttm_buffer_object *ttm_bo, bool evict,
 		goto out;
 	}
 
-	if (ttm_bo->type == ttm_bo_type_sg) {
-		if (new_mem->mem_type == XE_PL_SYSTEM)
-			ret = xe_bo_move_notify(bo, ctx);
-		if (!ret)
-			ret = xe_bo_move_dmabuf(ttm_bo, new_mem);
-		return ret;
-	}
-
 	tt_has_data = ttm && (ttm_tt_is_populated(ttm) || ttm_tt_is_swapped(ttm));
 
 	move_lacks_source = !old_mem || (handle_system_ccs ? (!bo->ccs_cleared) :
@@ -2379,10 +2398,16 @@ struct xe_bo *xe_bo_init_locked(struct xe_device *xe, struct xe_bo *bo,
 		}
 	}
 
-	/* Defer populating type_sg bos */
-	placement = (type == ttm_bo_type_sg ||
-		     bo->flags & XE_BO_FLAG_DEFER_BACKING) ? &sys_placement :
-		&bo->placement;
+	/*
+	 * For sg BOs (dma-buf imports) use sg_init_placement (num_placement=0)
+	 * so that ttm_bo_validate() leaves bo->resource = NULL. The BO is then
+	 * not on any LRU list before dma_buf_dynamic_attach() succeeds, which
+	 * prevents the LRU-walker UAF when attach fails.
+	 * For other BOs that request deferred backing, use sys_placement.
+	 */
+	placement = (type == ttm_bo_type_sg) ? &sg_init_placement :
+		    (bo->flags & XE_BO_FLAG_DEFER_BACKING) ? &sys_placement :
+		    &bo->placement;
 	err = ttm_bo_init_reserved(&xe->ttm, &bo->ttm, type,
 				   placement, alignment,
 				   &ctx, NULL, resv, xe_ttm_bo_destroy);
-- 
2.50.1