Re: [PATCH 1/2] RFC: drm/xe: Fix pinned list UAF panic

[Matthew Brost <matthew.brost@intel.com>]

On Thu, Oct 15, 2026 at 06:51:07AM -0700, Matthew Brost wrote:
> On Tue, Oct 06, 2026 at 10:57:40AM -0700, FNU VISHWANATHA wrote:
> > From: Kornel Dulęba <korneld@google.com>
> > 
> > A kernel panic caused by a list corruption was observed when the IPU6
> > driver is running under heavy load. The panic would reproduce
> > consistently within a few minutes of the test suite running, though
> > never during the same test. The corruption would always happen in
> > list_add_tail called from xe_bo_pin_external:
> > 
> > list_add corruption. prev->next should be next (ffff8bb9862912c8), but was ffff8bb9e811e2a8. (prev=ffff8bb9e811e2a8)
> > 
> > Having prev->next == prev, suggests that node was re-initialized without
> > being removed from the list first. This indicates that the BO might have
> > been destroyed while it was still pinned.
> 
> This is a bug if true.
> 
> > Looking into xe_ttm_bo_destroy and its caller ttm_bo_release, reveals
> > that the latter supports a case where bo->pin_count > 0, albeit with a
> > WARN_ON_ONCE. Since ttm_bo_release sets bo->pin_count to 0 in that case,
> > add a complementary change to also remove bo->pinned_link from the list.
> > With this applied, the test progresses much further, with the newly
> > added warning seen in dmesg.
> > 
> > Test: atest CtsCameraTestCases
> >
> 
> I don't doubt the test case but this an investigation for a proper fix.
>  
> > Signed-off-by: Kornel Dulęba <korneld@google.com>
> > ---
> >  drivers/gpu/drm/xe/xe_bo.c | 5 +++++
> >  1 file changed, 5 insertions(+)
> > 
> > diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c
> > index f2634d048cd4..c5989db950f7 100644
> > --- a/drivers/gpu/drm/xe/xe_bo.c
> > +++ b/drivers/gpu/drm/xe/xe_bo.c
> > @@ -1688,6 +1688,11 @@ static void xe_ttm_bo_destroy(struct ttm_buffer_object *ttm_bo)
> >  	if (bo->parent_obj)
> >  		xe_bo_put(bo->parent_obj);
> >  
> > +	spin_lock(&xe->pinned.lock);
> > +	if (WARN_ON_ONCE(!list_empty(&bo->pinned_link)))
> > +		list_del_init(&bo->pinned_link);
> > +	spin_unlock(&xe->pinned.lock);
> > +
> 
> It shouldn't be possible to get here with a BO on the pinned list, so
> this is papering over a bug some where else in the driver.
> 
> I'd prefer 'xe_assert(xe, !list_empty(&bo->pinned_link));' be added to

Inverted the logic...

s/!list_empty(&bo->pinned_link)/list_empty(&bo->pinned_link)/g

Matt

> the code to assert this and if this pops, we case down the root cause.
> 
> Can you please file a gitlab issue with the details of this failure so
> we assist debugging and get a proper fix?
> 
> Matt
> 
> >  	mutex_lock(&xe->mem_access.vram_userfault.lock);
> >  	if (!list_empty(&bo->vram_userfault_link))
> >  		list_del(&bo->vram_userfault_link);
> > -- 
> > 2.34.1
> >