Re: [PATCH v3 2/4] drm/xe/xe_migrate: Fix page tracking in access_memory

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Infinite recursion leading to kernel stack overflow in the unaligned bounce-buffer path when `kmalloc` does not return a cacheline-aligned address.
--

commit 3d0f83e8f2ae774cef204374c69860cdf0e2e7c3
Author: Christoph Manszewski <c.manszewski@gmail.com>

drm/xe/xe_migrate: Fix page tracking in access_memory

This commit updates xe_migrate_access_memory() to include the initial page
offset when recalculating current_page. This ensures that subsequent loop
iterations continue to index the mapped pages correctly.

> diff --git a/drivers/gpu/drm/xe/xe_migrate.c b/drivers/gpu/drm/xe/xe_migrate.c
> index 7da57dc522896..7b8148930738d 100644
> --- a/drivers/gpu/drm/xe/xe_migrate.c
> +++ b/drivers/gpu/drm/xe/xe_migrate.c
> @@ -2571,7 +2571,7 @@ int xe_migrate_access_memory(struct xe_migrate *m, struct xe_bo *bo,

[Severity: High]
This isn't a bug introduced by this patch, but is there a risk of an
infinite recursion in the bounce-buffer path of xe_migrate_access_memory()
when memory debugging is enabled?

If xe->info.has_mem_copy_instr is false and the access is unaligned, the
code allocates a bounce buffer:

    bounce = kmalloc(XE_CACHELINE_BYTES, GFP_KERNEL);

If KASAN or SLUB_DEBUG is enabled, kmalloc() may return a buffer that is
not cacheline-aligned due to redzones. The function then recursively
calls itself:

    err = xe_migrate_access_memory(m, bo,
                                   offset & ~XE_CACHELINE_MASK,
                                   bounce,
                                   XE_CACHELINE_BYTES, 0);

Because the bounce buffer is still unaligned, could the recursion base case
fail? This would cause it to allocate another bounce buffer and recurse
infinitely, potentially leading to a kernel stack overflow if an
unprivileged context triggers an unaligned memory access.

>  
>  		buf += current_bytes;
>  		offset += current_bytes;
> -		current_page = (int)(buf - orig_buf) / PAGE_SIZE;
> +		current_page = (int)(buf - orig_buf + page_offset) / PAGE_SIZE;
>  		bytes_left -= current_bytes;
>  		if (bytes_left)
>  			xe_res_next(&cursor, current_bytes);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260909061845.4048047-1-jan.maslak@intel.com?part=2