Linux kernel (drivers/gpu/drm/xe): Passing a sync object that fails fence lookup makes the exec ioctl return to

Impact

Passing a sync object that fails fence lookup makes the exec ioctl return to userspace while still holding the VM's dma-resv lock. That VM's buffers can then never be evicted, migrated or freed, so TTM eviction stalls and other tenants on the device are starved of VRAM until the node is rebooted.

Who can reach it

Tenant container holding /dev/dri/renderD* on Intel xe: call the exec ioctl with a syncobj handle whose in-fence lookup fails. One ioctl, deterministic, unprivileged.

What to do

Update to a kernel carrying the fix (stable commits below; no fixed_in published). Interim: none that is real - the lock is taken on the normal submit path; evacuate and reboot affected nodes.

References