Intel-XE Archive on lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] drm/xe: fix UAF race between exec-queue teardown and GuC CT pause-abort
@ 2026-11-13 13:21 Tejas Upadhyay
  2026-11-13 13:46 ` sashiko-bot
                   ` (5 more replies)
  0 siblings, 6 replies; 8+ messages in thread
From: Tejas Upadhyay @ 2026-11-13 13:21 UTC (permalink / raw)
  To: intel-xe; +Cc: himal.prasad.ghimiray, matthew.brost, arvind.yadav,
	Tejas Upadhyay

xe_guc_submit_pause_abort() walks guc->submission_state.exec_queue_lookup
and unconditionally calls guc_exec_queue_kill() on every entry found,
without verifying the queue hasn't already begun/finished its own
independent teardown. guc_exec_queue_fini() (run once a queue's own
refcount drops to zero via the normal close path) only erases its xarray
entry partway through its body, via release_guc_id() -- so there is a
window where a queue's refcount is already 0 but its xarray entry is
still present.

This was caught as a debug assertion firing on both BMG and CRI:

	xe 0000:00:03.0: [drm] Assertion `kref_read(&q->refcount)` failed!
	WARNING: drivers/gpu/drm/xe/xe_guc_submit.c:2242 at guc_exec_queue_kill+0x2e2/0x360 [xe]
	Call Trace:
	 guc_exec_queue_kill+0x2e2/0x360 [xe]
	 xe_guc_submit_pause_abort+0x8e/0xf0 [xe]
	 guc_submit_fini+0x11f/0x180 [xe]
	 devm_action_release+0x15/0x30
	 ...
	 device_release_driver_internal+0x230/0x270
	 unbind_store+0xac/0xc0                          [BMG: igt@xe_configfs, sysfs unbind]
	 pci_iov_remove_virtfn+0xd1/0x140
	 sriov_disable+0x42/0x100
	 pci_disable_sriov+0x23/0x40
	 xe_pci_sriov_configure+0x2b9/0x1350 [xe]
	 sriov_numvfs_store+0x136/0x1f0           [CRI: igt@xe_pmu, SR-IOV VF disable]

Pin the queue with kref_get_unless_zero() before touching it, skipping entries
that have already independently reached a zero refcount instead of operating on
an object that's already being torn down elsewhere.

Signed-off-by: Tejas Upadhyay <tejas.upadhyay@intel.com>
---
 drivers/gpu/drm/xe/xe_guc_submit.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c
index d76f125f9c3a..7a3bd698f217 100644
--- a/drivers/gpu/drm/xe/xe_guc_submit.c
+++ b/drivers/gpu/drm/xe/xe_guc_submit.c
@@ -3306,12 +3306,18 @@ void xe_guc_submit_pause_abort(struct xe_guc *guc)
 	xa_for_each(&guc->submission_state.exec_queue_lookup, index, q) {
 		struct xe_gpu_scheduler *sched = &q->guc->sched;
 
-		/* Prevent redundant attempts to stop parallel queues */
-		if (q->guc->id != index)
+		/*
+		 * Prevent redundant attempts to stop parallel queues, and skip
+		 * queues already dropped to a zero refcount via their own
+		 * independent teardown (guc_exec_queue_fini(), xarray entry
+		 * not yet erased)
+		 */
+		if (q->guc->id != index || !kref_get_unless_zero(&q->refcount))
 			continue;
 
 		xe_sched_submission_start(sched);
 		guc_exec_queue_kill(q);
+		xe_exec_queue_put(q);
 	}
 	mutex_unlock(&guc->submission_state.lock);
 }
-- 
2.52.0


^ permalink raw reply related	[flat|nested] 8+ messages in thread

end of thread, other threads:[~2026-11-13 15:55 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-11-13 13:21 [PATCH] drm/xe: fix UAF race between exec-queue teardown and GuC CT pause-abort Tejas Upadhyay
2026-11-13 13:46 ` sashiko-bot
2026-11-13 15:53   ` Matthew Brost
2026-11-13 13:58 ` ✗ CI.checkpatch: warning for " Patchwork
2026-11-13 14:00 ` ✓ CI.KUnit: success " Patchwork
2026-11-13 14:31 ` ✓ Xe.CI.BAT: " Patchwork
2026-11-13 15:20 ` [PATCH] " Raag Jadav
2026-11-13 15:55 ` Matthew Brost

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox