Linux kernel (drivers/gpu/drm/xe): The Xe userptr path takes folio locks while holding the MMU notifier lock, which

Impact

The Xe userptr path takes folio locks while holding the MMU notifier lock, which inverts against core-kernel page migration doing the reverse. A tenant using userptr GPU mappings can deadlock the notifier against memory compaction/migration, hanging tasks that have nothing to do with the GPU and taking the node out for every workload on it.

Who can reach it

Any container with /dev/dri/renderD* on an Intel Xe host that registers userptr GPU mappings over its own anonymous memory; the collision happens when the kernel's page migration batches those folios at the same time as the driver marks them accessed/dirty. Needs no privilege - just userptr use plus normal memory pressure or THP compaction on the node.

What to do

Update to 6.12.25 / 6.14 or later, which drops the unnecessary mark-accessed/dirty under the notifier lock. Interim: deny render-node access to untrusted tenants on xe hosts; nothing in the driver disables userptr independently.

References