Re: [PATCH V20 06/15] drm/xe: Guard teardown paths against purged BOs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] xe_bo_unpin_external() is missing the xe_bo_is_purged() guard, which will cause a crash when unpinning purged DMA-buf exports.
- [High] xe_dma_buf_begin_cpu_access() fails to check if the BO is purged.
--

commit 58df7bf49c93c1c7134f73fd8224de6fa0f907f3
Author: Tejas Upadhyay <tejas.upadhyay@intel.com>
Subject: drm/xe: Guard teardown paths against purged BOs

This commit adds xe_bo_is_purged guards to various teardown and mapping
paths in the xe driver. It prevents unpinning or mapping a buffer object
that has already been purged by VRAM page offlining.

> diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c
> index c255327669da5..b162753cebb70 100644
> --- a/drivers/gpu/drm/xe/xe_bo.c
> +++ b/drivers/gpu/drm/xe/xe_bo.c
> @@ -3267,6 +3267,9 @@ void xe_bo_unpin(struct xe_bo *bo)
>  	struct ttm_place *place = &bo->placements[0];
>  	struct xe_device *xe = xe_bo_device(bo);
>  
> +	if (xe_bo_is_purged(bo))
> +		return;
> +

[Severity: High]
Does xe_bo_unpin_external also need a check for purged BOs?

When a DMA-buf exported BO is purged, closing the DMA-buf file descriptor
from userspace will call xe_dma_buf_unpin, which calls xe_bo_unpin_external:

drivers/gpu/drm/xe/xe_dma_buf.c:xe_dma_buf_unpin() {
	...
	xe_bo_unpin_external(bo);
}

Because xe_bo_unpin_external lacks the xe_bo_is_purged check, it will
attempt to unpin an already-unpinned BO. This leads to a pin_count underflow
and fails the assertion:

drivers/gpu/drm/xe/xe_bo.c:xe_bo_unpin_external() {
	...
	xe_assert(xe, !bo->vm);
	xe_assert(xe, xe_bo_is_pinned(bo));
	...
}

>  	xe_assert(xe, !bo->ttm.base.import_attach);
>  	xe_assert(xe, xe_bo_is_pinned(bo));
>  
> diff --git a/drivers/gpu/drm/xe/xe_dma_buf.c b/drivers/gpu/drm/xe/xe_dma_buf.c
> index bf0728838ead5..5d9f1cd24b7f3 100644
> --- a/drivers/gpu/drm/xe/xe_dma_buf.c
> +++ b/drivers/gpu/drm/xe/xe_dma_buf.c
> @@ -104,6 +104,9 @@ static struct sg_table *xe_dma_buf_map(struct dma_buf_attachment *attach,
>  	struct sg_table *sgt;
>  	int r = 0;
>  
> +	if (xe_bo_is_purged(bo))
> +		return ERR_PTR(-ENOENT);
> +

[Severity: High]
Does xe_dma_buf_begin_cpu_access need a similar guard against purged BOs?

If a DMA-buf exported BO is purged, and userspace invokes the
DMA_BUF_IOCTL_SYNC ioctl to begin CPU access, xe_dma_buf_begin_cpu_access
will call xe_bo_migrate:

drivers/gpu/drm/xe/xe_dma_buf.c:xe_dma_buf_begin_cpu_access() {
	...
	xe_validation_guard(...) {
		ret = drm_exec_lock_obj(&exec, &bo->ttm.base);
		...
		ret = xe_bo_migrate(bo, XE_PL_TT, NULL, &exec);
	...
}

Without an xe_bo_is_purged check before migrating, xe_bo_migrate will try
to migrate a destroyed buffer object. This can cause a NULL pointer
dereference since bo->ttm.resource->mem_type can be NULL for purged BOs,
or it will silently migrate the empty backing store to XE_PL_TT, providing
userspace with garbage memory.

>  	if (!attach->peer2peer && !xe_bo_can_migrate(bo, XE_PL_TT))
>  		return ERR_PTR(-EOPNOTSUPP);
>  

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260902145343.465686-17-tejas.upadhyay@intel.com?part=6