[PATCH] drm/xe: free madvise VMA array on L2 flush failure

[PATCH] drm/xe: free madvise VMA array on L2 flush failure

[Guangshuo Li]

xe_vm_madvise_ioctl() allocates madvise_range.vmas in get_vmas().
After get_vmas() succeeds with at least one VMA, error paths must go
through free_vmas so the array is released before the madvise details are
destroyed.

The L2 flush validation path added for PAT madvise rejects some
SVM/userptr ranges after get_vmas() has succeeded, but jumps directly to
madv_fini. This skips kfree(madvise_range.vmas), leaking the VMA array on
each failed ioctl.

Jump to free_vmas instead, matching the other validation failure paths
after get_vmas() has succeeded.

Fixes: 4f39a194d41e ("drm/xe/xe3p_lpg: Restrict UAPI to enable L2 flush optimization")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/gpu/drm/xe/xe_vm_madvise.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/xe/xe_vm_madvise.c b/drivers/gpu/drm/xe/xe_vm_madvise.c
index c4fb29004195..246fe1843142 100644
--- a/drivers/gpu/drm/xe/xe_vm_madvise.c
+++ b/drivers/gpu/drm/xe/xe_vm_madvise.c
@@ -643,7 +643,7 @@ int xe_vm_madvise_ioctl(struct drm_device *dev, void *data, struct drm_file *fil
 				 xe_device_is_l2_flush_optimized(xe) &&
 				 (pat_index != 19 && coh_mode != XE_COH_2WAY))) {
 			err = -EINVAL;
-			goto madv_fini;
+			goto free_vmas;
 		}
 	}
 
-- 
2.43.0

✗ LGCI.VerificationFailed: failure for drm/xe: free madvise VMA array on L2 flush failure

[Patchwork]

== Series Details ==

Series: drm/xe: free madvise VMA array on L2 flush failure
URL   : https://patchwork.freedesktop.org/series/170006/
State : failure

== Summary ==

Series author address 'lgs201920130244@gmail.com' is not on the allowlist, which prevents CI from being automatically triggered.
If you want CI to run for this series, ask Patchwork project owners to click 'retest' on the series in Patchwork.
Exception occurred during validation, bailing out!
Build URL: http://intel-gfx-ci-public.igk.intel.com:8080/job/xe_pw_trigger/1209616/ (on master)

Re: [PATCH] drm/xe: free madvise VMA array on L2 flush failure

[Rodrigo Vivi]

On Wed, Jul 08, 2026 at 03:34:22PM +0800, Guangshuo Li wrote:
> xe_vm_madvise_ioctl() allocates madvise_range.vmas in get_vmas().
> After get_vmas() succeeds with at least one VMA, error paths must go
> through free_vmas so the array is released before the madvise details are
> destroyed.
> 
> The L2 flush validation path added for PAT madvise rejects some
> SVM/userptr ranges after get_vmas() has succeeded, but jumps directly to
> madv_fini. This skips kfree(madvise_range.vmas), leaking the VMA array on
> each failed ioctl.
> 
> Jump to free_vmas instead, matching the other validation failure paths
> after get_vmas() has succeeded.
> 
> Fixes: 4f39a194d41e ("drm/xe/xe3p_lpg: Restrict UAPI to enable L2 flush optimization")
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>

Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>

and pushed to drm-xe-next

> ---
>  drivers/gpu/drm/xe/xe_vm_madvise.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_vm_madvise.c b/drivers/gpu/drm/xe/xe_vm_madvise.c
> index c4fb29004195..246fe1843142 100644
> --- a/drivers/gpu/drm/xe/xe_vm_madvise.c
> +++ b/drivers/gpu/drm/xe/xe_vm_madvise.c
> @@ -643,7 +643,7 @@ int xe_vm_madvise_ioctl(struct drm_device *dev, void *data, struct drm_file *fil
>  				 xe_device_is_l2_flush_optimized(xe) &&
>  				 (pat_index != 19 && coh_mode != XE_COH_2WAY))) {
>  			err = -EINVAL;
> -			goto madv_fini;
> +			goto free_vmas;
>  		}
>  	}
>  
> -- 
> 2.43.0
>