Re: [RFC 4/4] drm/xe: Bump prefetch BO LRU for already-valid ranges

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] drm/xe: memory leak of svm_range on prefetch_lru_bump failure
--

commit 09ec19c469b99c340c07a04780a85f997af72901
Author: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>

drm/xe: Bump prefetch BO LRU for already-valid ranges

This commit introduces xe_svm_range_prefetch_lru_bump to re-fault CPU pages
without touching DMA mappings and move backing BOs to the LRU tail for
already-valid prefetch ranges.

> diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c
> index fe9ccaa129122..948060a702470 100644
> --- a/drivers/gpu/drm/xe/xe_vm.c
> +++ b/drivers/gpu/drm/xe/xe_vm.c

[ ... ]

> @@ -2583,6 +2583,15 @@ vm_bind_ioctl_ops_create(struct xe_vm *vm, struct xe_vma_ops *vops,
>  						  dpagemap, &valid_pages)) {
>  				xe_svm_range_debug(svm_range, "PREFETCH - RANGE IS VALID");
>  				xe_assert(vm->xe, valid_pages);
> +
> +				if (dpagemap) {
> +					err = xe_svm_range_prefetch_lru_bump(vm, vma,
> +									     svm_range,
> +									     dpagemap);
> +					if (err)
> +						goto unwind_prefetch_ops;

[Severity: Medium]
Does this code leak the svm_range?

During a VM_BIND ioctl with prefetch, xe_svm_range_find_or_insert() returns
an svm_range with an incremented reference count. If 
xe_svm_range_prefetch_lru_bump() fails here, we jump to unwind_prefetch_ops.

Because this error path is taken before the svm_range is tracked in the
op->prefetch_range.range xarray, the cleanup routine
xe_svm_prefetch_gpuva_ops_fini() will not know about it and will not free it.

Should this error path call xe_svm_range_put(svm_range) before jumping to
unwind_prefetch_ops to avoid leaking the reference?

> +				}
> +
>  				need_put = true;
>  				goto check_next_range;
>  			}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260916112828.2528881-6-himal.prasad.ghimiray@intel.com?part=4