Re: [PATCH 5/6] drm/xe: Correct migration VM teardown order

["Summers, Stuart" <stuart.summers@intel.com>]

On Tue, 2025-10-14 at 17:59 -0700, Matthew Brost wrote:
> On Tue, Oct 14, 2025 at 06:09:26PM +0000, Stuart Summers wrote:
> > Adjust the sequence of the migration teardown to match what
> > is happening in the init() function.
> > 
> > Signed-off-by: Stuart Summers <stuart.summers@intel.com>
> > ---
> >  drivers/gpu/drm/xe/xe_migrate.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/drivers/gpu/drm/xe/xe_migrate.c
> > b/drivers/gpu/drm/xe/xe_migrate.c
> > index 7345a5b65169..b1747e442a7b 100644
> > --- a/drivers/gpu/drm/xe/xe_migrate.c
> > +++ b/drivers/gpu/drm/xe/xe_migrate.c
> > @@ -100,8 +100,8 @@ static void xe_migrate_fini(void *arg)
> >         xe_bo_put(m->pt_bo);
> >         drm_suballoc_manager_fini(&m->vm_update_sa);
> >         mutex_destroy(&m->job_mutex);
> > -       xe_vm_close_and_put(m->q->vm);
> >         xe_exec_queue_put(m->q);
> > +       xe_vm_close_and_put(m->q->vm);
> 
> You have UAF here as m->q can be destroyed by xe_exec_queue_put.
> 
> If you want to switch up this ordering that is fine but m->q->vm
> needs
> to stored on the stack before xe_exec_queue_put.

Good catch Matt thanks. I'll fix and resubmit. Doing a little more
testing on BMG to make sure we don't have some regression here before I
post a new rev.

Thanks,
Stuart

> 
> Matt
> 
> >  }
> >  
> >  static u64 xe_migrate_vm_addr(u64 slot, u32 level)
> > -- 
> > 2.34.1
> >