Re: drm/xe/oa: Zero OA buffer at allocation

["Ghimiray, Himal Prasad" <himal.prasad.ghimiray@intel.com>]

On 06-10-2026 07:33, Bommu Krishnaiah wrote:
> ttm_bo_type_kernel BOs are not guaranteed to be zeroed on allocation and
> may contain data from previously freed pages. Since the OA buffer is
> mmap'able by userspace, this can expose stale kernel memory contents.
> 
> Streams opened with DRM_XE_OA_PROPERTY_OA_DISABLED allocate the OA
> buffer without calling xe_oa_init_oa_buffer(). Zero the buffer at
> allocation to prevent information disclosure through mmap.
> 
> The existing zeroing in xe_oa_init_oa_buffer() remains necessary for
> zero report-id/timestamp detection on enable/re-enable.
> 
> Fixes: 392bf22238ff ("drm/xe/oa/uapi: OA buffer mmap")
> Assisted-by: LLM
> Cc: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
> Cc: Ghimiray, Himal Prasad <himal.prasad.ghimiray@intel.com>
> Signed-off-by: Bommu Krishnaiah <krishnaiah.bommu@intel.com>

Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>

> ---
>   drivers/gpu/drm/xe/xe_oa.c | 7 +++++++
>   1 file changed, 7 insertions(+)
> 
> diff --git a/drivers/gpu/drm/xe/xe_oa.c b/drivers/gpu/drm/xe/xe_oa.c
> index a3484e943c55..3bb8bbef4c37 100644
> --- a/drivers/gpu/drm/xe/xe_oa.c
> +++ b/drivers/gpu/drm/xe/xe_oa.c
> @@ -914,6 +914,13 @@ static int xe_oa_alloc_oa_buffer(struct xe_oa_stream *stream, size_t size)
>   	if (IS_ERR(bo))
>   		return PTR_ERR(bo);
>   
> +	/*
> +	 * ttm_bo_type_kernel BOs are not zeroed on allocation, so the buffer can
> +	 * hold stale data from previously freed pages. Since the OA buffer is
> +	 * mmap'able by userspace, clear it here to avoid leaking kernel memory.
> +	 */
> +	xe_map_memset(stream->oa->xe, &bo->vmap, 0, 0, xe_bo_size(bo));
> +
>   	stream->oa_buffer.bo = bo;
>   
>   	stream->oa_buffer.bounce = kmalloc(stream->oa_buffer.format->size, GFP_KERNEL);