Re: [PATCH v5 6/8] drm/xe/mmio_gem: fix destroy flow

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] GFP_KERNEL allocation under dma_resv lock triggers lockdep splat and potential deadlock
--

commit 6f195ca9ff5839faa94b4a50effe5cb10176e87b
Author: Ilia Levi <ilia.levi@intel.com>
Subject: drm/xe/mmio_gem: fix destroy flow

This commit fixes a use-after-free in the gem object destroy flow by
introducing proper synchronization and refcounting. It uses the dma_resv lock
to serialize the fault handler with the destroy operation and unmaps existing
pages to cut off access to the real mmio after destruction.

> diff --git a/drivers/gpu/drm/xe/xe_mmio_gem.c b/drivers/gpu/drm/xe/xe_mmio_gem.c
> index 970b1e2f49815..5ffe03d361902 100644
> --- a/drivers/gpu/drm/xe/xe_mmio_gem.c
> +++ b/drivers/gpu/drm/xe/xe_mmio_gem.c
[ ... ]
> @@ -176,10 +189,9 @@ static int alloc_dummy_page_if_needed(struct drm_gem_object *base)
>  {
>  	struct xe_mmio_gem *obj = to_xe_mmio_gem(base);
>  
> -	dma_resv_lock(base->resv, NULL);
> +	dma_resv_assert_held(base->resv);
>  	if (!obj->dummy_page)
>  		obj->dummy_page = alloc_page(GFP_KERNEL | __GFP_ZERO);

[Severity: High]
This isn't a bug introduced by this patch, but does this allocation context
create a lockdep violation or potential deadlock?

The vma fault handler calls xe_mmio_gem_vm_fault, which takes the
dma_resv_lock. If the device is unplugged, it eventually calls
alloc_dummy_page_if_needed, executing alloc_page(GFP_KERNEL | __GFP_ZERO)
while holding base->resv. Since dma_resv locks are taken by shrinkers during
memory reclaim, holding it while doing a GFP_KERNEL allocation creates a
circular dependency.

This can be reached by any unprivileged userspace process that mmaps the mmio
gem object and triggers a page fault while the device is in an unplugged
state.

> -	dma_resv_unlock(base->resv);
>  
>  	return obj->dummy_page ? 0 : -ENOMEM;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260908165046.1393557-10-matthew.auld@intel.com?part=6