Re: [PATCH v5 09/25] drm/xe: Add struct xe_pt_job_ops

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Ignored return value of xe_pt_walk_shared() in xe_pt_stage_unbind() can cause partial unbinds leading to device memory Use-After-Free.
--

commit becaaccdc6df0bb083fdb6279921f5ee714da885
Author: Matthew Brost <matthew.brost@intel.com>

drm/xe: Add struct xe_pt_job_ops

Add struct xe_pt_job_ops, a dynamically refcounted object that contains
the information required to issue a CPU bind via a job after the initial
bind IOCTL returns.

Link: https://patch.msgid.link/20260228013501.106680-10-matthew.brost@intel.com

> diff --git a/drivers/gpu/drm/xe/xe_pt.c b/drivers/gpu/drm/xe/xe_pt.c
> index e560f167fdf1b..30127ebf1b605 100644
> --- a/drivers/gpu/drm/xe/xe_pt.c
> +++ b/drivers/gpu/drm/xe/xe_pt.c

[ ... ]

> @@ -2081,13 +2094,13 @@ xe_pt_commit_prepare_unbind(struct xe_vma *vma,

[Severity: Critical]
This is a pre-existing issue, but is it safe to ignore the return value of
xe_pt_walk_shared() in xe_pt_stage_unbind() just above this diff?

If memory allocation fails during VMA unbind, the page table walk is
prematurely aborted. The function casts the error to (void) and returns the
count of successfully processed entries:

drivers/gpu/drm/xe/xe_pt.c:xe_pt_stage_unbind() {
    ...
	(void)xe_pt_walk_shared(&pt->base, pt->level, start, end,
				&xe_walk.base);
    ...
}

If the caller proceeds to unbind only that subset of PTEs, does this allow
the physical memory backing the VMA to be freed and reallocated to another
process while the GPU retains a valid PTE mapping to it?

If an unprivileged user triggers this by allocating and unmapping memory
while intentionally applying memory pressure to force an allocation failure,
can this result in a use-after-free and memory corruption?

>  static struct xe_vm_pgtable_update_op *
>  to_pt_op(struct xe_vm_pgtable_update_ops *pt_update_ops, u32 op_idx)
>  {
> -	return &pt_update_ops->ops[op_idx];
> +	return &pt_update_ops->pt_job_ops->ops[op_idx];
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260904022207.3490018-1-matthew.brost@intel.com?part=9