Linux kernel (drivers/gpu/drm/xe): On the migration error path the previous fence is released before the code waits on

Impact

On the migration error path the previous fence is released before the code waits on it, so the wait runs against freed memory. Migration is what moves buffer objects between VRAM and system memory under pressure, so a tenant that keeps the GPU memory-constrained can reach this use-after-free while other tenants' buffers are being evicted around it.

Who can reach it

A tenant container holding /dev/dri/renderD* on an Intel xe GPU triggers it through ordinary buffer-object migration/eviction, forced by allocating VRAM until eviction kicks in and then failing the copy. No special capability, no display path, no host root.

What to do

Boot a kernel carrying the xe_migrate fence-ordering fix below. Interim: cap per-tenant VRAM so a single container cannot keep the device in constant eviction, which is the state that exercises this path.

References