LMTT allocation publishes a newly allocated child page table before
recursing into the next level. If a lower-level allocation fails, the
error path freed the page table directly but left the parent's software
entry and hardware PTE pointing at it.
The caller's failure cleanup then calls xe_lmtt_drop_pages(), which can
walk the stale entry and destroy the same subtree again. The stale PTE
also remains visible until the next invalidation.
Clear the parent software entry, write an invalid PTE, invalidate the
hardware view, and then destroy the partially allocated subtree.
This issue was found by a static analysis checker and confirmed by
manual source review.
Fixes: b1d204058218 ("drm/xe/pf: Introduce Local Memory Translation Table")
Signed-off-by: Ruoyu Wang <[email protected]>
---
drivers/gpu/drm/xe/xe_lmtt.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/xe/xe_lmtt.c b/drivers/gpu/drm/xe/xe_lmtt.c
index 0c726eda93906..9b0f8d4b26abc 100644
--- a/drivers/gpu/drm/xe/xe_lmtt.c
+++ b/drivers/gpu/drm/xe/xe_lmtt.c
@@ -406,8 +406,13 @@ static int __lmtt_alloc_range(struct xe_lmtt *lmtt, struct
xe_lmtt_pt *pd,
if (pt->level != 0) {
err = __lmtt_alloc_range(lmtt, pt, offset, next);
- if (err)
+ if (err) {
+ pd->entries[idx] = NULL;
+ lmtt_write_pte(lmtt, pd, LMTT_PTE_INVALID, idx);
+ lmtt_invalidate_hw(lmtt);
+ lmtt_destroy_pt(lmtt, pt);
return err;
+ }
}
offset = next;
@@ -453,7 +458,10 @@ static int lmtt_alloc_range(struct xe_lmtt *lmtt, unsigned
int vfid, u64 start,
return 0;
out_free_pt:
- lmtt_pt_free(pt);
+ pd->entries[vfid] = NULL;
+ lmtt_write_pte(lmtt, pd, LMTT_PTE_INVALID, vfid);
+ lmtt_invalidate_hw(lmtt);
+ lmtt_destroy_pt(lmtt, pt);
return err;
}
--
2.51.0
