Re: [PATCH v5 2/2] drm/xe: Keep imported sg BOs off LRU until dma-buf attach succeeds

["Thomas Hellström" <thomas.hellstrom@linux.intel.com>]

On Wed, 2026-07-08 at 14:45 +0530, Nitin Gote wrote:
> Imported dma-buf BOs are created as ttm_bo_type_sg with bo->base.resv
> pointing at the exporter's resv. They are initialized with system
> placement, which allocates a ttm_resource and makes the BO visible to
> TTM LRU walkers before dma_buf_dynamic_attach() has succeeded.
> 
> If attach fails, xe holds no dma-buf reference, but an LRU walker may
> already have referenced the BO and locked bo->base.resv (the exporter
> resv). If the exporter is then freed, this is a use-after-free.
> 
> Use an empty initial placement for imported sg BOs so bo->resource
> stays NULL and the BO is never added to an LRU before attach
> succeeds.
> 
> As a result sg BOs now start without a resource, so their first move
> has old_mem == NULL. Check ttm_bo_type_sg before the creation path in
> xe_bo_move() so imports always use the dma-buf move path, 


> and handle
> resource-less sg BOs in xe_evict_flags() before dereferencing
> tbo->resource.

Better if evict is not called on them at all. Could we have the dma-buf
move_notify immediately return 0 if the bo has no resource?

> 
> Cc: Thomas Hellstrom <thomas.hellstrom@linux.intel.com>
> Cc: Christian Koenig <christian.koenig@amd.com>
> Cc: Matthew Auld <matthew.auld@intel.com>
> Assisted-by: GitHub_Copilot:claude-sonnet-4.6
> Signed-off-by: Nitin Gote <nitin.r.gote@intel.com>
> ---
>  drivers/gpu/drm/xe/xe_bo.c | 53 ++++++++++++++++++++++++++++--------
> --
>  1 file changed, 39 insertions(+), 14 deletions(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c
> index 85e6d9a0f575..050de0f13232 100644
> --- a/drivers/gpu/drm/xe/xe_bo.c
> +++ b/drivers/gpu/drm/xe/xe_bo.c
> @@ -63,6 +63,12 @@ static struct ttm_placement sys_placement = {
>  
>  static struct ttm_placement purge_placement;
>  
> +/* Initial placement: keeps imported sg BOs resource-less (off the
> LRU)
> + * until dma_buf_dynamic_attach() succeeds so they are not visible
> to LRU
> + * walkers while bo->base.resv still points at the exporter.
> + */
> +static struct ttm_placement sg_init_placement;
> +
>  static const struct ttm_place tt_placement_flags[] = {
>  	{
>  		.fpfn = 0,
> @@ -342,9 +348,14 @@ static void xe_evict_flags(struct
> ttm_buffer_object *tbo,
>  	}
>  
>  	/*
> -	 * For xe, sg bos that are evicted to system just triggers a
> -	 * rebind of the sg list upon subsequent validation to
> XE_PL_TT.
> +	 * sg BOs (dma-buf imports) evict to system and may have no
> +	 * resource yet, so handle them before dereferencing tbo-
> >resource.
>  	 */
> +	if (tbo->type == ttm_bo_type_sg) {
> +		*placement = sys_placement;
> +		return;
> +	}
> +

.. and then if possible skip the above changes?

Thanks,
Thomas



>  	switch (tbo->resource->mem_type) {
>  	case XE_PL_VRAM0:
>  	case XE_PL_VRAM1:
> @@ -980,6 +991,22 @@ static int xe_bo_move(struct ttm_buffer_object
> *ttm_bo, bool evict,
>  		return 0;
>  	}
>  
> +	/*
> +	 * sg BOs (dma-buf imports) must always be moved via the
> dmabuf path,
> +	 * regardless of whether they have an existing resource.
> This check must
> +	 * come before the creation-path check below: sg BOs start
> with no
> +	 * resource (sg_init_placement), so their first move to
> XE_PL_TT has
> +	 * old_mem == NULL, which would otherwise incorrectly
> trigger the
> +	 * creation path and call xe_tt_map_sg() instead of
> xe_bo_move_dmabuf().
> +	 */
> +	if (ttm_bo->type == ttm_bo_type_sg) {
> +		if (new_mem->mem_type == XE_PL_SYSTEM)
> +			ret = xe_bo_move_notify(bo, ctx);
> +		if (!ret)
> +			ret = xe_bo_move_dmabuf(ttm_bo, new_mem);
> +		return ret;
> +	}
> +
>  	/* Bo creation path, moving to system or TT. */
>  	if ((!old_mem && ttm) && !handle_system_ccs) {
>  		if (new_mem->mem_type == XE_PL_TT)
> @@ -989,14 +1016,6 @@ static int xe_bo_move(struct ttm_buffer_object
> *ttm_bo, bool evict,
>  		goto out;
>  	}
>  
> -	if (ttm_bo->type == ttm_bo_type_sg) {
> -		if (new_mem->mem_type == XE_PL_SYSTEM)
> -			ret = xe_bo_move_notify(bo, ctx);
> -		if (!ret)
> -			ret = xe_bo_move_dmabuf(ttm_bo, new_mem);
> -		return ret;
> -	}
> -
>  	tt_has_data = ttm && (ttm_tt_is_populated(ttm) ||
> ttm_tt_is_swapped(ttm));
>  
>  	move_lacks_source = !old_mem || (handle_system_ccs ? (!bo-
> >ccs_cleared) :
> @@ -2379,10 +2398,16 @@ struct xe_bo *xe_bo_init_locked(struct
> xe_device *xe, struct xe_bo *bo,
>  		}
>  	}
>  
> -	/* Defer populating type_sg bos */
> -	placement = (type == ttm_bo_type_sg ||
> -		     bo->flags & XE_BO_FLAG_DEFER_BACKING) ?
> &sys_placement :
> -		&bo->placement;
> +	/*
> +	 * For sg BOs (dma-buf imports) use sg_init_placement
> (num_placement=0)
> +	 * so that ttm_bo_validate() leaves bo->resource = NULL. The
> BO is then
> +	 * not on any LRU list before dma_buf_dynamic_attach()
> succeeds, which
> +	 * prevents the LRU-walker UAF when attach fails.
> +	 * For other BOs that request deferred backing, use
> sys_placement.
> +	 */
> +	placement = (type == ttm_bo_type_sg) ? &sg_init_placement :
> +		    (bo->flags & XE_BO_FLAG_DEFER_BACKING) ?
> &sys_placement :
> +		    &bo->placement;
>  	err = ttm_bo_init_reserved(&xe->ttm, &bo->ttm, type,
>  				   placement, alignment,
>  				   &ctx, NULL, resv,
> xe_ttm_bo_destroy);