[PATCH] drm/xe: Release the SVM prefetch ranges of unparsed ops

[PATCH] drm/xe: Release the SVM prefetch ranges of unparsed ops

[Changyul Lee]

vm_bind_ioctl_ops_create() stores SVM ranges, each with a reference, in
op->prefetch_range.range for every PREFETCH op on a CPU address mirror
VMA. xe_vma_ops_fini() releases them only for the ops on vops->list.
When vm_bind_ioctl_ops_parse() fails, the ops after the failing one are
never added to that list, and xe_vm_bind_ioctl() frees them with
drm_gpuva_ops_free(), leaking their XArray nodes and range references.
A PREFETCH that covers a userptr VMA and a CPU address mirror VMA after
it does this when pinning the userptr pages fails.

Release the prefetch ranges of all ops before freeing them. Ranges
already released through vops->list leave an empty XArray, which
xe_vma_svm_prefetch_ranges_fini() skips.

Fixes: 09ba0a8f06cd ("drm/xe/svm: Implement prefetch support for SVM ranges")
Signed-off-by: Changyul Lee <lcy8047@gmail.com>
---
Found with a static analysis tool we are developing.

Compile-tested only, with x86_64_defconfig plus DRM_XE, DRM_XE_GPUSVM
and W=1.

 drivers/gpu/drm/xe/xe_vm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c
index d25de5652767..ee35ead79371 100644
--- a/drivers/gpu/drm/xe/xe_vm.c
+++ b/drivers/gpu/drm/xe/xe_vm.c
@@ -4208,8 +4208,10 @@ int xe_vm_bind_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
 		vm_bind_ioctl_ops_unwind(vm, ops, args->num_binds);
 	xe_vma_ops_fini(&vops);
 	for (i = args->num_binds - 1; i >= 0; --i)
-		if (ops[i])
+		if (ops[i]) {
+			xe_svm_prefetch_gpuva_ops_fini(ops[i]);
 			drm_gpuva_ops_free(&vm->gpuvm, ops[i]);
+		}
 free_syncs:
 	if (err == -ENODATA)
 		err = vm_bind_ioctl_signal_fences(vm, q, syncs, num_syncs);

base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb
-- 
2.43.0

Re: [PATCH] drm/xe: Release the SVM prefetch ranges of unparsed ops

[Matthew Brost]

On Thu, Nov 12, 2026 at 11:42:39PM -0500, Changyul Lee wrote:
> vm_bind_ioctl_ops_create() stores SVM ranges, each with a reference, in
> op->prefetch_range.range for every PREFETCH op on a CPU address mirror
> VMA. xe_vma_ops_fini() releases them only for the ops on vops->list.
> When vm_bind_ioctl_ops_parse() fails, the ops after the failing one are
> never added to that list, and xe_vm_bind_ioctl() frees them with
> drm_gpuva_ops_free(), leaking their XArray nodes and range references.
> A PREFETCH that covers a userptr VMA and a CPU address mirror VMA after
> it does this when pinning the userptr pages fails.
> 
> Release the prefetch ranges of all ops before freeing them. Ranges
> already released through vops->list leave an empty XArray, which
> xe_vma_svm_prefetch_ranges_fini() skips.
> 

I believe I see the potential problem. I think this is right and safe
assuming xa_destroy is safe to be called twice which is appears to be.

Our CI will give use definitive answer which I have triggered your
behalf.

With that:
Reviewed-by: Matthew Brost <matthew.brost@intel.com> 

> Fixes: 09ba0a8f06cd ("drm/xe/svm: Implement prefetch support for SVM ranges")
> Signed-off-by: Changyul Lee <lcy8047@gmail.com>
> ---
> Found with a static analysis tool we are developing.
> 
> Compile-tested only, with x86_64_defconfig plus DRM_XE, DRM_XE_GPUSVM
> and W=1.
> 
>  drivers/gpu/drm/xe/xe_vm.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c
> index d25de5652767..ee35ead79371 100644
> --- a/drivers/gpu/drm/xe/xe_vm.c
> +++ b/drivers/gpu/drm/xe/xe_vm.c
> @@ -4208,8 +4208,10 @@ int xe_vm_bind_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
>  		vm_bind_ioctl_ops_unwind(vm, ops, args->num_binds);
>  	xe_vma_ops_fini(&vops);
>  	for (i = args->num_binds - 1; i >= 0; --i)
> -		if (ops[i])
> +		if (ops[i]) {
> +			xe_svm_prefetch_gpuva_ops_fini(ops[i]);
>  			drm_gpuva_ops_free(&vm->gpuvm, ops[i]);
> +		}
>  free_syncs:
>  	if (err == -ENODATA)
>  		err = vm_bind_ioctl_signal_fences(vm, q, syncs, num_syncs);
> 
> base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb
> -- 
> 2.43.0
>