Re: Patch "drm/xe: Fix shrinker accounting double-subtraction on nested external pins" has been added to the 6.18-stable tree

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] drm/xe: list corruption and UAF on fb unpin of externally pinned BOs
--

commit 877c19cc3340fbb074cda1d52d8508b429d1bf00
Author: Thomas Hellström <thomas.hellstrom@linux.intel.com>

drm/xe: Fix shrinker accounting double-subtraction on nested external pins

This patch centralizes shrinker accounting into xe_bo_account_pin() and
xe_bo_account_unpin(). It ensures accounting is only updated on the outermost
pin and the final unpin, addressing a double-subtraction issue on nested
external pins.

Link: https://patch.msgid.link/20261002100830.12297-2-thomas.hellstrom@linux.intel.com

> diff --git a/drivers/gpu/drm/xe/display/xe_fb_pin.c b/drivers/gpu/drm/xe/display/xe_fb_pin.c
> index 1fd4a815e784b..7e2b4dbef4d76 100644
> --- a/drivers/gpu/drm/xe/display/xe_fb_pin.c
> +++ b/drivers/gpu/drm/xe/display/xe_fb_pin.c
[ ... ]
> @@ -362,7 +362,7 @@ static void __xe_unpin_fb_vma(struct i915_vma *vma)
>  		xe_ggtt_node_remove(vma->node, false);
>  
>  	ttm_bo_reserve(&vma->bo->ttm, false, false, NULL);
> -	ttm_bo_unpin(&vma->bo->ttm);
> +	xe_bo_unpin_account(vma->bo);
>  	ttm_bo_unreserve(&vma->bo->ttm);
>  	kfree(vma);
>  }

[Severity: High]
Does this code leave a stale pinned_link entry if a BO is pinned both externally
and as a framebuffer?

If a BO has a pin_count of 2 from being pinned both externally and as a
framebuffer, xe_bo_unpin_external() in drivers/gpu/drm/xe/xe_bo.c will reduce
the count to 1 and skip list removal because of its bo->ttm.pin_count == 1
check.

When __xe_unpin_fb_vma() in drivers/gpu/drm/xe/display/xe_fb_pin.c is later
called for the final unpin (dropping pin_count to 0), it only calls
xe_bo_unpin_account(). It lacks the logic to acquire xe->pinned.lock and call
list_del_init(&bo->pinned_link).

Could this result in the BO being freed while its pinned_link remains in
xe->pinned.late.external, leading to list corruption and a Use-After-Free
if the list is iterated later? I note the commit message mentions this was
addressed in a separate follow-up patch, but I am including it here as it
was flagged during review.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/2026101225-abacus-errand-7132@gregkh?part=1