Re: [PATCH v7 01/24] drm/xe: reference VM from PT BOs

[Matthew Brost <matthew.brost@intel.com>]

On Fri, Sep 25, 2026 at 02:00:22PM +0200, Francois Dugast wrote:
> Nit: first letter of the commit title is usually capitalized.
> 
> On Thu, Sep 24, 2026 at 09:52:57PM -0700, Matthew Brost wrote:
> > PT BOs share the VM's dma-resv and therefore must keep the VM alive
> > until all PT BOs are destroyed.
> >  
> > Take a VM reference from PT BOs to ensure the shared dma-resv remains
> > valid for the lifetime of the BOs. Scope the change to PT BOs rather
> > than all kernel BOs to minimize risk and avoid extending VM lifetimes
> > unnecessarily.
> > 
> > Signed-off-by: Matthew Brost <matthew.brost@intel.com>
> 
> Did you observe any side effect without this change in earlier versions
> of this series?

No, just Sashiko (correctly) complaining. The kmalloc in
individualization step would have to fail to get a UAF, thus pretty hard
for issues to show up. We might have issues here in other existing code
path if that happens but wanted to keep this change minimal rather than
auditing the entire driver.

Again Christian's series to ref count dma-resv is the real fix for
memory safety around dma-resv sharing. Hopefully we gets that in soon -
I basically gave him my ack to merge it but subsystem wide change so
might get held up.

Matt

> 
> Reviewed-by: Francois Dugast <francois.dugast@intel.com>
> 
> > ---
> >  drivers/gpu/drm/xe/xe_bo.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> > 
> > diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c
> > index f2ab9bf43a86..6921b6967330 100644
> > --- a/drivers/gpu/drm/xe/xe_bo.c
> > +++ b/drivers/gpu/drm/xe/xe_bo.c
> > @@ -1879,7 +1879,7 @@ static void xe_ttm_bo_destroy(struct ttm_buffer_object *ttm_bo)
> >  		xe_drm_client_remove_bo(bo);
> >  #endif
> >  
> > -	if (bo->vm && xe_bo_is_user(bo))
> > +	if (bo->vm && (xe_bo_is_user(bo) || bo->flags & XE_BO_FLAG_PAGETABLE))
> >  		xe_vm_put(bo->vm);
> >  
> >  	if (bo->parent_obj)
> > @@ -2575,7 +2575,7 @@ __xe_bo_create_locked(struct xe_device *xe,
> >  	 * by having all the vm's bo refereferences released at vm close
> >  	 * time.
> >  	 */
> > -	if (vm && xe_bo_is_user(bo))
> > +	if (vm && (xe_bo_is_user(bo) || bo->flags & XE_BO_FLAG_PAGETABLE))
> >  		xe_vm_get(vm);
> >  	bo->vm = vm;
> >  
> > -- 
> > 2.34.1
> >