Re: [PATCH 1/2] RFC: drm/xe: Fix pinned list UAF panic

[Matthew Brost <matthew.brost@intel.com>]

On Tue, Oct 06, 2026 at 10:57:40AM -0700, FNU VISHWANATHA wrote:
> From: Kornel Dulęba <korneld@google.com>
> 
> A kernel panic caused by a list corruption was observed when the IPU6
> driver is running under heavy load. The panic would reproduce
> consistently within a few minutes of the test suite running, though
> never during the same test. The corruption would always happen in
> list_add_tail called from xe_bo_pin_external:
> 
> list_add corruption. prev->next should be next (ffff8bb9862912c8), but was ffff8bb9e811e2a8. (prev=ffff8bb9e811e2a8)
> 
> Having prev->next == prev, suggests that node was re-initialized without
> being removed from the list first. This indicates that the BO might have
> been destroyed while it was still pinned.

This is a bug if true.

> Looking into xe_ttm_bo_destroy and its caller ttm_bo_release, reveals
> that the latter supports a case where bo->pin_count > 0, albeit with a
> WARN_ON_ONCE. Since ttm_bo_release sets bo->pin_count to 0 in that case,
> add a complementary change to also remove bo->pinned_link from the list.
> With this applied, the test progresses much further, with the newly
> added warning seen in dmesg.
> 
> Test: atest CtsCameraTestCases
>

I don't doubt the test case but this an investigation for a proper fix.
 
> Signed-off-by: Kornel Dulęba <korneld@google.com>
> ---
>  drivers/gpu/drm/xe/xe_bo.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c
> index f2634d048cd4..c5989db950f7 100644
> --- a/drivers/gpu/drm/xe/xe_bo.c
> +++ b/drivers/gpu/drm/xe/xe_bo.c
> @@ -1688,6 +1688,11 @@ static void xe_ttm_bo_destroy(struct ttm_buffer_object *ttm_bo)
>  	if (bo->parent_obj)
>  		xe_bo_put(bo->parent_obj);
>  
> +	spin_lock(&xe->pinned.lock);
> +	if (WARN_ON_ONCE(!list_empty(&bo->pinned_link)))
> +		list_del_init(&bo->pinned_link);
> +	spin_unlock(&xe->pinned.lock);
> +

It shouldn't be possible to get here with a BO on the pinned list, so
this is papering over a bug some where else in the driver.

I'd prefer 'xe_assert(xe, !list_empty(&bo->pinned_link));' be added to
the code to assert this and if this pops, we case down the root cause.

Can you please file a gitlab issue with the details of this failure so
we assist debugging and get a proper fix?

Matt

>  	mutex_lock(&xe->mem_access.vram_userfault.lock);
>  	if (!list_empty(&bo->vram_userfault_link))
>  		list_del(&bo->vram_userfault_link);
> -- 
> 2.34.1
>