From mboxrd@z Thu Jan  1 00:00:00 1970
From: Claude Code Review Bot <claude-review@example.com>
To: dri-devel-reviews@example.com
Subject: Claude review: drm/xe/xe_pagefault: Disallow writes to read-only VMAs
Date: Wed, 11 Mar 2026 13:12:59 +1000
Message-ID: <review-patch1-20260310144914.7525-7-jonathan.cavitt@intel.com>
In-Reply-To: <20260310144914.7525-7-jonathan.cavitt@intel.com>
References: <20260310144914.7525-6-jonathan.cavitt@intel.com> <20260310144914.7525-7-jonathan.cavitt@intel.com>
X-Mailer: Claude Code Patch Reviewer
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0

Patch Review

This is tagged as a `Fixes:` patch, which is good.

**Bug: access_type comparison doesn't mask out prefetch bit.** The `access_=
type` field packs the actual access type in bits [1:0] and a prefetch flag =
in bit 7. The check:

```c
if (xe_vma_read_only(vma) &&
    pf->consumer.access_type !=3D XE_PAGEFAULT_ACCESS_TYPE_READ) {
```

compares the raw `access_type` value, so a READ prefetch (`0x80`) would be =
incorrectly rejected as non-read. The existing `xe_pagefault_access_is_atom=
ic()` at line 139 of xe_pagefault.c already demonstrates the correct patter=
n =E2=80=94 mask first:

```c
return (access_type & XE_PAGEFAULT_ACCESS_TYPE_MASK) =3D=3D XE_PAGEFAULT_AC=
CESS_TYPE_ATOMIC;
```

The fix should be:
```c
if (xe_vma_read_only(vma) &&
    (pf->consumer.access_type & XE_PAGEFAULT_ACCESS_TYPE_MASK) !=3D XE_PAGE=
FAULT_ACCESS_TYPE_READ) {
```

Notably, patch 4 adds `xe_to_user_access_type()` which correctly uses the m=
ask, yet this patch doesn't. This is a real bug since prefetch faults on re=
ad-only VMAs would be wrongly rejected with `-EPERM` instead of being servi=
ced.

---
Generated by Claude Code Patch Reviewer