Re: [PATCH v4 0/4] Have xe_vm and xe_exec_queue take references to xef

[Matthew Brost <matthew.brost@intel.com>]

On Thu, Jul 18, 2024 at 02:05:44PM -0700, Umesh Nerlige Ramappa wrote:
> Just posting the revision that will be pushed for reference. This rev
> only has documentation changes compared to v2, so will not run CI on
> this.
> -----
> xe_file_close triggers an asynchronous queue cleanup and then frees up
> the xef object. Since queue cleanup flushes all pending jobs and the KMD
> stores client usage stats into the xef object after jobs are flushed, we
> see a use-after-free for the xef object. Resolve this by taking a
> reference to xef from xe_exec_queue.
> 
> Issue: https://gitlab.freedesktop.org/drm/xe/kernel/issues/1908

It looks like not having ref to vm->xref is causing other issues too [1]
[2].

Let's get this in ASAP.

Matt

[1] https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2273
[2] https://patchwork.freedesktop.org/patch/605099/?series=136240&rev=1

> 
> The series adds xef refcounting and ensures all consumers of xef take a
> ref to it.
> 
> v2:
> - Include review comments from v1
> - Squash patch 3 and 5 from v1 to add Fixes/Closes tags
> 
> v3:
> - kernel-doc fixes (Lucas, Matt)
> 
> v4: Rebase to drm-tip
> 
> Note: Patches 1 - 3 can be merged independently
> 
> Signed-off-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
> 
> Umesh Nerlige Ramappa (4):
>   drm/xe: Move part of xe_file cleanup to a helper
>   drm/xe: Add ref counting for xe_file
>   drm/xe: Take a ref to xe file when user creates a VM
>   drm/xe: Fix use after free when client stats are captured
> 
>  drivers/gpu/drm/xe/xe_device.c           | 58 +++++++++++++++++++-----
>  drivers/gpu/drm/xe/xe_device.h           |  3 ++
>  drivers/gpu/drm/xe/xe_device_types.h     |  3 ++
>  drivers/gpu/drm/xe/xe_drm_client.c       |  5 +-
>  drivers/gpu/drm/xe/xe_exec_queue.c       | 10 +++-
>  drivers/gpu/drm/xe/xe_exec_queue_types.h |  7 ++-
>  drivers/gpu/drm/xe/xe_vm.c               |  6 ++-
>  7 files changed, 71 insertions(+), 21 deletions(-)
> 
> -- 
> 2.38.1
>