Re: [PATCH v2] drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC

[Matthew Brost <matthew.brost@intel.com>]

On Wed, Jun 24, 2026 at 11:19:44PM +0530, Himal Prasad Ghimiray wrote:
> When prefetch region is DRM_XE_CONSULT_MEM_ADVISE_PREF_LOC for a BO VMA,
> the code used it as an index into region_to_mem_type[], causing an
> out-of-bounds access since the value is -1.
> 
> Resolve the preferred location for BO VMAs directly: local VRAM on dGFX
> (using the BO's tile placement) or system memory on iGPU.
> 
> Discovered using AI-assisted static analysis confirmed by Intel Product
> Security.
> 
> v2:
> -Fix null dereference
> 
> Reported-by: Martin Hodo <martin.hodo@intel.com>
> Fixes: c1bb69a2e8e2 ("drm/xe/svm: Consult madvise preferred location in prefetch")
> Cc: Matthew Brost <matthew.brost@intel.com>
> Signed-off-by: Himal Prasad Ghimiray<himal.prasad.ghimiray@intel.com>
> ---
>  drivers/gpu/drm/xe/xe_vm.c | 25 ++++++++++++++++++++-----
>  1 file changed, 20 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c
> index 080c2fff0e95..32ded13491ca 100644
> --- a/drivers/gpu/drm/xe/xe_vm.c
> +++ b/drivers/gpu/drm/xe/xe_vm.c
> @@ -3255,11 +3255,26 @@ static int op_lock_and_prep(struct drm_exec *exec, struct xe_vm *vm,
>  						    .request_decompress = false,
>  						    .check_purged = true,
>  					    });
> -		if (!err && !xe_vma_has_no_bo(vma))
> -			err = xe_bo_migrate(xe_vma_bo(vma),
> -					    region_to_mem_type[region],
> -					    NULL,
> -					    exec);
> +		if (!err && !xe_vma_has_no_bo(vma)) {
> +			struct xe_bo *bo = xe_vma_bo(vma);
> +			u32 mem_type;
> +
> +			if (region == DRM_XE_CONSULT_MEM_ADVISE_PREF_LOC) {

Shouldn't logic more or less look like xe_vma_resolve_pagemap which
picks the region based on vma->attr.preferred_loc.devmem_fd?

So roughly:

mem_type = mem_type = bo->placements[i].mem_type;

for (i = 0; i < bo->placement.num_placement; i++) {
	if(mem_type_is_vram(bo->placements[i].mem_type) &&
	   vma->attr.preferred_loc.devmem_fd == DRM_XE_PREFERRED_LOC_DEFAULT_DEVICE) {
		mem_type = bo->placements[i].mem_type;
		break;
	} else if (!mem_type_is_vram(bo->placements[i].mem_type &&
		   vma->attr.preferred_loc.devmem_fd == DRM_XE_PREFERRED_LOC_DEFAULT_SYSTEM) {
		mem_type = bo->placements[i].mem_type;
		break;
	}
}

Matt

> +				unsigned int i;
> +
> +				mem_type = XE_PL_TT;
> +				for (i = 0; i < bo->placement.num_placement; i++) {
> +					if (mem_type_is_vram(bo->placements[i].mem_type)) {
> +						mem_type = bo->placements[i].mem_type;
> +						break;
> +					}
> +				}
> +			} else {
> +				mem_type = region_to_mem_type[region];
> +			}
> +
> +			err = xe_bo_migrate(bo, mem_type, NULL, exec);
> +		}
>  		break;
>  	}
>  	default:
> -- 
> 2.43.0
>