Intel-XE Archive on lore.kernel.org
 help / color / mirror / Atom feed
* drm/xe/oa: Zero OA buffer at allocation
@ 2026-10-06  2:03 Bommu Krishnaiah
  2026-10-06  1:59 ` ✓ CI.KUnit: success for drm/xe/oa: Zero OA buffer at allocation (rev2) Patchwork
                   ` (4 more replies)
  0 siblings, 5 replies; 6+ messages in thread
From: Bommu Krishnaiah @ 2026-10-06  2:03 UTC (permalink / raw)
  To: intel-xe; +Cc: Bommu Krishnaiah, Umesh Nerlige Ramappa, Ghimiray, Himal Prasad

ttm_bo_type_kernel BOs are not guaranteed to be zeroed on allocation and
may contain data from previously freed pages. Since the OA buffer is
mmap'able by userspace, this can expose stale kernel memory contents.

Streams opened with DRM_XE_OA_PROPERTY_OA_DISABLED allocate the OA
buffer without calling xe_oa_init_oa_buffer(). Zero the buffer at
allocation to prevent information disclosure through mmap.

The existing zeroing in xe_oa_init_oa_buffer() remains necessary for
zero report-id/timestamp detection on enable/re-enable.

Fixes: 392bf22238ff ("drm/xe/oa/uapi: OA buffer mmap")
Assisted-by: LLM
Cc: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
Cc: Ghimiray, Himal Prasad <himal.prasad.ghimiray@intel.com>
Signed-off-by: Bommu Krishnaiah <krishnaiah.bommu@intel.com>
---
 drivers/gpu/drm/xe/xe_oa.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/gpu/drm/xe/xe_oa.c b/drivers/gpu/drm/xe/xe_oa.c
index a3484e943c55..3bb8bbef4c37 100644
--- a/drivers/gpu/drm/xe/xe_oa.c
+++ b/drivers/gpu/drm/xe/xe_oa.c
@@ -914,6 +914,13 @@ static int xe_oa_alloc_oa_buffer(struct xe_oa_stream *stream, size_t size)
 	if (IS_ERR(bo))
 		return PTR_ERR(bo);
 
+	/*
+	 * ttm_bo_type_kernel BOs are not zeroed on allocation, so the buffer can
+	 * hold stale data from previously freed pages. Since the OA buffer is
+	 * mmap'able by userspace, clear it here to avoid leaking kernel memory.
+	 */
+	xe_map_memset(stream->oa->xe, &bo->vmap, 0, 0, xe_bo_size(bo));
+
 	stream->oa_buffer.bo = bo;
 
 	stream->oa_buffer.bounce = kmalloc(stream->oa_buffer.format->size, GFP_KERNEL);
-- 
2.43.0


^ permalink raw reply related	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-10-07 16:48 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-06  2:03 drm/xe/oa: Zero OA buffer at allocation Bommu Krishnaiah
2026-10-06  1:59 ` ✓ CI.KUnit: success for drm/xe/oa: Zero OA buffer at allocation (rev2) Patchwork
2026-10-06  2:43 ` ✓ Xe.CI.BAT: " Patchwork
2026-10-06  5:38 ` drm/xe/oa: Zero OA buffer at allocation Ghimiray, Himal Prasad
2026-10-06 12:24 ` ✓ Xe.CI.FULL: success for drm/xe/oa: Zero OA buffer at allocation (rev2) Patchwork
2026-10-07 16:48 ` drm/xe/oa: Zero OA buffer at allocation Umesh Nerlige Ramappa

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox