Re: [RFC v2 6/9] drm/xe/bo: Prevent mmap of purged buffer objects

[Matthew Brost <matthew.brost@intel.com>]

On Mon, Dec 01, 2025 at 11:20:16AM +0530, Arvind Yadav wrote:
> Fail DRM_IOCTL_XE_GEM_MMAP_OFFSET with -EINVAL when called on purged
> buffer objects to provide early error detection instead of allowing
> deferred SIGBUS on memory access.
> 
> Problem:
>   The mmap offset ioctl (DRM_IOCTL_XE_GEM_MMAP_OFFSET) returns a file
>   offset that userspace can pass to mmap() to map GPU memory into its
>   address space. For purged BOs, the backing store has been freed, but
>   the VMA node offset remains valid. Without this check:
> 
>   1. Userspace successfully gets mmap offset for purged BO
>   2. mmap() succeeds (VMA is created but has no backing pages)
>   3. Any memory access triggers CPU page fault
>   4. xe_bo_cpu_fault() detects purged state and returns VM_FAULT_SIGBUS
> 
> v2:
>   - Fix reference counting: use drm_gem_object_put() instead of xe_bo_put()
>     to properly balance drm_gem_object_lookup() (review feedback).
>   - Added xe_bo_is_purged(bo) instead of atomic_read.
> 
> Cc: Matthew Brost <matthew.brost@intel.com>
> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
> Signed-off-by: Arvind Yadav <arvind.yadav@intel.com>
> ---
>  drivers/gpu/drm/xe/xe_bo.c | 11 +++++++++++
>  1 file changed, 11 insertions(+)
> 
> diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c
> index 7f5bcf114ed4..dbbfb58ac657 100644
> --- a/drivers/gpu/drm/xe/xe_bo.c
> +++ b/drivers/gpu/drm/xe/xe_bo.c
> @@ -3346,6 +3346,7 @@ int xe_gem_mmap_offset_ioctl(struct drm_device *dev, void *data,
>  	struct xe_device *xe = to_xe_device(dev);
>  	struct drm_xe_gem_mmap_offset *args = data;
>  	struct drm_gem_object *gem_obj;
> +	struct xe_bo *bo;
>  
>  	if (XE_IOCTL_DBG(xe, args->extensions) ||
>  	    XE_IOCTL_DBG(xe, args->reserved[0] || args->reserved[1]))
> @@ -3375,6 +3376,16 @@ int xe_gem_mmap_offset_ioctl(struct drm_device *dev, void *data,
>  	if (XE_IOCTL_DBG(xe, !gem_obj))
>  		return -ENOENT;
>  
> +	bo = gem_to_xe_bo(gem_obj);
> +
> +	/*
> +	 * Reject mmap offset requests for purged BOs.
> +	 */
> +	if (xe_bo_is_purged(bo)) {

I don't think this is needed. A subsequent CPU page fault would just
fail with SIGBUS. As discussed in patch 2/5 we'd have the BO's dma-resv
lock there too making this check race free.

Matt

> +		drm_gem_object_put(gem_obj);
> +		return -EINVAL;
> +	}
> +
>  	/* The mmap offset was set up at BO allocation time. */
>  	args->offset = drm_vma_node_offset_addr(&gem_obj->vma_node);
>  
> -- 
> 2.43.0
>