[PATCH] drm/xe: Release the SVM prefetch ranges of unparsed ops

[Changyul Lee <lcy8047@gmail.com>]

vm_bind_ioctl_ops_create() stores SVM ranges, each with a reference, in
op->prefetch_range.range for every PREFETCH op on a CPU address mirror
VMA. xe_vma_ops_fini() releases them only for the ops on vops->list.
When vm_bind_ioctl_ops_parse() fails, the ops after the failing one are
never added to that list, and xe_vm_bind_ioctl() frees them with
drm_gpuva_ops_free(), leaking their XArray nodes and range references.
A PREFETCH that covers a userptr VMA and a CPU address mirror VMA after
it does this when pinning the userptr pages fails.

Release the prefetch ranges of all ops before freeing them. Ranges
already released through vops->list leave an empty XArray, which
xe_vma_svm_prefetch_ranges_fini() skips.

Fixes: 09ba0a8f06cd ("drm/xe/svm: Implement prefetch support for SVM ranges")
Signed-off-by: Changyul Lee <lcy8047@gmail.com>
---
Found with a static analysis tool we are developing.

Compile-tested only, with x86_64_defconfig plus DRM_XE, DRM_XE_GPUSVM
and W=1.

 drivers/gpu/drm/xe/xe_vm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c
index d25de5652767..ee35ead79371 100644
--- a/drivers/gpu/drm/xe/xe_vm.c
+++ b/drivers/gpu/drm/xe/xe_vm.c
@@ -4208,8 +4208,10 @@ int xe_vm_bind_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
 		vm_bind_ioctl_ops_unwind(vm, ops, args->num_binds);
 	xe_vma_ops_fini(&vops);
 	for (i = args->num_binds - 1; i >= 0; --i)
-		if (ops[i])
+		if (ops[i]) {
+			xe_svm_prefetch_gpuva_ops_fini(ops[i]);
 			drm_gpuva_ops_free(&vm->gpuvm, ops[i]);
+		}
 free_syncs:
 	if (err == -ENODATA)
 		err = vm_bind_ioctl_signal_fences(vm, q, syncs, num_syncs);

base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb
-- 
2.43.0