[GSD-14204] Double close() of a file descriptor during zeInit / zeInitDrivers on xe (survivability_mode probe)

The report concerns a double close during zeInit / zeInitDrivers on the xe driver in the survivability mode probe, but the payload ends before the full actual behavior or any source files and tests are named. Start by reading the remainder of the issue and tracing those initialization entry points to the file descriptor close calls. Done means reproducing the double close and confirming initialization closes the descriptor only once.

Pre-submission Checklist

• I am using the latest GPU driver version (releases)
• I have searched for similar issues and found none

GPU Hardware

Intel Arc Pro B70

DRI Devices Information

  ls -la /dev/dri/by-path/
lrwxrwxrwx - root  8 Nov 18:22  pci-0000:03:00.0-card -> ../card0
lrwxrwxrwx - root  8 Nov 18:21  pci-0000:03:00.0-platform-simple-framebuffer.0-card -> ../card0
lrwxrwxrwx - root  8 Nov 18:22  pci-0000:03:00.0-render -> ../renderD128

GPU Detailed Information (lspci output)

sudo lspci -vvv -k -s 0000:03:00.0
03:00.0 VGA compatible controller: Intel Corporation Battlemage G31 [Arc Pro B70] (prog-if 00 [VGA controller])
	Subsystem: Intel Corporation Device 1701
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0, Cache Line Size: 64 bytes
	Interrupts: unknown pin routed to IRQ 259, MSI(X) routed to IRQ 259
	IOMMU group: 18
	Region 0: Memory at 17fb000000 (64-bit, prefetchable) [size=16M]
	Region 2: Memory at 1800000000 (64-bit, prefetchable) [size=32G]
	Expansion ROM at ddc00000 [disabled] [size=2M]
	Capabilities: [40] Vendor Specific Information: Intel Capabilities v1
		CapA: Peg60Dis- Peg12Dis- Peg11Dis- Peg10Dis- PeLWUDis- DmiWidth=x4
		     EccDis- ForceEccEn- VTdDis- DmiG2Dis- PegG2Dis- DDRMaxSize=Unlimited
		     1NDis- CDDis- DDPCDis- X2APICEn- PDCDis- IGDis- CDID=0 CRID=0
		     DDROCCAP+ OCEn- DDRWrtVrefEn+ DDR3LEn+
		CapB: ImguDis- OCbySSKUCap- OCbySSKUEn- SMTCap- CacheSzCap 0x0
		     SoftBinCap- DDR3MaxFreqWithRef100=Disabled PegG3Dis-
		     PkgTyp- AddGfxEn- AddGfxCap- PegX16Dis- DmiG3Dis- GmmDis-
		     DDR3MaxFreq=2932MHz LPDDR3En-
	Capabilities: [70] Express (v2) Endpoint, IntMsgNum 0
		DevCap:	MaxPayload 256 bytes, PhantFunc 0, Latency L0s unlimited, L1 unlimited
			ExtTag+ AttnBtn- AttnInd- PwrInd- RBE+ FLReset+ SlotPowerLimit 0W TEE-IO-
		DevCtl:	CorrErr- NonFatalErr- FatalErr- UnsupReq-
			RlxdOrd+ ExtTag+ PhantFunc- AuxPwr- NoSnoop+ FLReset-
			MaxPayload 256 bytes, MaxReadReq 512 bytes
		DevSta:	CorrErr- NonFatalErr- FatalErr- UnsupReq- AuxPwr- TransPend+
		LnkCap:	Port #0, Speed 2.5GT/s, Width x1, ASPM L0s L1, Exit Latency L0s <64ns, L1 <1us
			ClockPM- Surprise- LLActRep- BwNot- ASPMOptComp+
		LnkCtl:	ASPM Disabled; RCB 64 bytes, LnkDisable- CommClk-
			ExtSynch- ClockPM- AutWidDis- BWInt- AutBWInt- FltModeDis-
		LnkSta:	Speed 2.5GT/s, Width x1
			TrErr- Train- SlotClk- DLActive- BWMgmt- ABWMgmt-
		DevCap2: Completion Timeout: Range B, TimeoutDis+ NROPrPrP- LTR+
			10BitTagComp+ 10BitTagReq+ OBFF Not Supported, ExtFmt+ EETLPPrefix-
			EmergencyPowerReduction Not Supported, EmergencyPowerReductionInit-
			FRS- TPHComp- ExtTPHComp-
			AtomicOpsCap: 32bit- 64bit- 128bitCAS-
		DevCtl2: Completion Timeout: 50us to 50ms, TimeoutDis-
			AtomicOpsCtl: ReqEn-
			IDOReq- IDOCompl- LTR+ EmergencyPowerReductionReq-
			10BitTagReq- OBFF Disabled, EETLPPrefixBlk-
		LnkCap2: Supported Link Speeds: 2.5GT/s, Crosslink- Retimer- 2Retimers- DRS-
		LnkCtl2: Target Link Speed: 2.5GT/s, EnterCompliance- SpeedDis-
			Transmit Margin: Normal Operating Range, EnterModifiedCompliance- ComplianceSOS-
			Compliance Preset/De-emphasis: -6dB de-emphasis, 0dB preshoot
		LnkSta2: Current De-emphasis Level: -6dB, EqualizationComplete- EqualizationPhase1-
			EqualizationPhase2- EqualizationPhase3- LinkEqualizationRequest-
			Retimer- 2Retimers- CrosslinkRes: unsupported, FltMode-
	Capabilities: [ac] MSI: Enable+ Count=1/1 Maskable+ 64bit+
		Address: 00000000fee00000  Data: 0000
		Masking: 00000000  Pending: 00000000
	Capabilities: [d0] Power Management version 3
		Flags: PMEClk- DSI- D1- D2- AuxCurrent=0mA PME(D0+,D1-,D2-,D3hot+,D3cold-)
		Status: D0 NoSoftRst+ PME-Enable- DSel=0 DScale=0 PME-
	Capabilities: [100 v1] Alternative Routing-ID Interpretation (ARI)
		ARICap:	MFVC- ACS-, Next Function: 0
		ARICtl:	MFVC- ACS-, Function Group: 0
	Capabilities: [110 v1] Null
	Capabilities: [200 v1] Address Translation Service (ATS)
		ATSCap:	Invalidate Queue Depth: 00
		ATSCtl:	Enable+, Smallest Translation Unit: 00
	Capabilities: [420 v1] Physical Resizable BAR
		BAR 2: current size: 32GB, supported: 256MB 512MB 1GB 2GB 4GB 8GB 16GB 32GB
	Capabilities: [220 v1] Virtual Resizable BAR
		BAR 2: current size: 8GB, supported: 256MB 512MB 1GB 2GB 4GB 8GB 16GB 32GB
	Capabilities: [320 v1] Single Root I/O Virtualization (SR-IOV)
		IOVCap:	Migration- 10BitTagReq+ IntMsgNum 0
		IOVCtl:	Enable- Migration- Interrupt- MSE- ARIHierarchy+ 10BitTagReq-
		IOVSta:	Migration-
		Initial VFs: 4, Total VFs: 4, Number of VFs: 0, Function Dependency Link: 00
		VF offset: 1, stride: 1, Device ID: e223
		Supported Page Size: 00000553, System Page Size: 00000001
		Region 0: Memory at 00000017fc000000 (64-bit, prefetchable)
		Region 2: Memory at 0000002000000000 (64-bit, prefetchable)
		VF Migration: offset: 00000000, BIR: 0
	Capabilities: [400 v1] Latency Tolerance Reporting
		Max snoop latency: 1048576ns
		Max no snoop latency: 1048576ns
	Kernel driver in use: xe
	Kernel modules: xe

Driver Version

26.40.40196.8

Installed GPU Driver Packages

sudo dpkg --list | grep -iE "igc|gmm|opencl|level-zero|fc|level_zero|ocloc|libze"
ii  bpfcc-tools                                      0.35.0+ds-1ubuntu4                         all          tools for BPF Compiler Collection (BCC)
ii  clinfo                                           3.0.25.02.14-1build1                       amd64        Query OpenCL system information
ii  intel-igc-core-2                                 2.42.6                                     amd64        Intel(R) Graphics Compiler for OpenCL(TM)
ii  intel-igc-opencl-2                               2.42.6                                     amd64        Intel(R) Graphics Compiler for OpenCL(TM)
ii  intel-ocloc                                      26.40.40196.8-0                            amd64        Tool for managing Intel Compute GPU device binary format
ii  intel-opencl-icd                                 26.40.40196.8-0                            amd64        Intel graphics compute runtime for OpenCL
ii  intel-opencl-icd-legacy                          24.35.30872.45-1                           amd64        Intel graphics compute runtime for OpenCL -- legacy platforms
ii  libbpfcc:amd64                                   0.35.0+ds-1ubuntu4                         amd64        shared library for BPF Compiler Collection (BCC)
ii  libcbor0.10:amd64                                0.10.2-2.1ubuntu1                          amd64        library for parsing and generating CBOR (RFC 7049)
ii  libdebconfclient0:amd64                          0.280ubuntu1                               amd64        Debian Configuration Management System (C-implementation library)
ii  libfile-fcntllock-perl                           0.22-4ubuntu7                              amd64        Perl module for file locking with fcntl(2)
ii  libigc1:amd64                                    1.0.17791.18+1-3                           amd64        Intel graphics compiler for OpenCL -- core libs
ii  libigc2:amd64                                    2.40.14-1                                  amd64        Intel graphics compiler for OpenCL -- core libs
ii  libigdfcl1:amd64                                 1.0.17791.18+1-3                           amd64        Intel graphics compiler for OpenCL -- OpenCL library
ii  libigdfcl2:amd64                                 2.40.14-1                                  amd64        Intel graphics compiler for OpenCL -- OpenCL library
ii  libigdgmm12:amd64                                22.10.2                                    amd64        Intel Graphics Memory Management Library -- shared library
ii  libze-dev                                        1.35.0                                     amd64        oneAPI Level Zero
ii  libze-intel-gpu-legacy1-1                        24.35.30872.45-1                           amd64        Intel oneAPI L0 support implementation for Intel legacy GPUs
ii  libze-intel-gpu1                                 26.40.40196.8-0                            amd64        Intel(R) Graphics Compute Runtime for oneAPI Level Zero.
ii  libze1                                           1.35.0                                     amd64        oneAPI Level Zero
ii  linux-firmware-qlogic                            20260915.git1522c78a-0ubuntu1              all          Firmware for QLogic SCSI, FC, and IB host bus and Ethernet adapters
ii  ocl-icd-libopencl1:amd64                         2.3.4-1                                    amd64        Generic OpenCL ICD Loader
ii  ocl-icd-opencl-dev:amd64                         2.3.4-1                                    amd64        OpenCL development files
ii  opencl-c-headers                                 3.0~2025.07.22-2build1                     all          OpenCL (Open Computing Language) C header files
ii  opencl-clhpp-headers                             3.0~2025.07.22-1ubuntu2                    all          C++ headers for OpenCL development
ii  opencl-headers                                   3.0~2025.07.22-2build1                     all          OpenCL (Open Computing Language) header files
ii  python3-bpfcc                                    0.35.0+ds-1ubuntu4                         all          Python 3 wrappers for BPF Compiler Collection (BCC)
ii  python3-idna                                     3.18-1                                     all          Python IDNA2008 (RFC 5891) handling (Python 3)

Driver Installation Details

• Installation method: Intel GitHub release packages (compute-runtime release 26.40.40196.8), installed over the Ubuntu 26.10 distribution packages
• Steps: downloaded the .deb assets listed in the compute-runtime 26.40.40196.8 release notes (intel-igc-core-2 and intel-igc-opencl-2 2.42.6, libigdgmm12 22.10.2, intel-opencl-icd, libze-intel-gpu1 and intel-ocloc 26.40.40196.8), plus libze1 and libze-dev 1.35.0 from oneapi-src/level-zero (u24.04). Verified sha256 against ww40.sum and the GitHub asset digests, then: sudo apt install ./*.deb
• Previously (where the bug was first seen): Ubuntu 26.10 distribution repository, libze-intel-gpu1 26.27.39122.14, libigc2 2.40.14, libze1 1.32.0
• Followed guide: compute-runtime 26.40.40196.8 release notes (Installation procedure on Ubuntu)
• Kernel: 7.3.0-10-generic, xe driver, no custom kernel parameters

Linux Distribution

Other (please specify below)

Other Linux Distribution

26.10

Kernel Version & Boot Parameters

 cat /proc/cmdline
─────┬──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
     │ File: /proc/cmdline
─────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   1 │ BOOT_IMAGE=/boot/vmlinuz-7.3.0-10-generic root=UUID=09d3128f-9afd-4d0f-8673-739fcc36cbf7 ro quiet splash crashkernel=2G-4G:320M,4
     │ G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
─────┴──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

lsmod | grep -E 'i915|xe'
xe                   4694016  81
drm_gpusvm_helper      65536  1 xe
intel_vsec             24576  2 pmt_telemetry,xe
gpu_sched              73728  1 xe
drm_gpuvm              57344  1 xe
drm_buddy              12288  1 xe
drm_ttm_helper         20480  1 xe
ttm                   163840  2 drm_ttm_helper,xe
drm_exec               16384  2 drm_gpuvm,xe
drm_suballoc_helper    24576  1 xe
drm_display_helper    323584  1 xe
cec                   106496  2 drm_display_helper,xe
i2c_algo_bit           20480  1 xe
video                  81920  1 xe

Actual Behavior

During driver initialisation, libze_intel_gpu.so.1 (still present in the latest release 26.40.40196.8, libze_intel_gpu.so.1.18.40196; also seen in 26.27.39122 and the legacy1 build 1.5.30872) closes the same file descriptor twice. The second close returns EBADF:

openat(AT_FDCWD, "/sys/bus/pci/drivers/xe", O_RDONLY|O_DIRECTORY) = 4
close(4) = 0
openat(AT_FDCWD, "/sys/bus/pci/drivers/xe/0000:03:00.0/survivability_mode", O_RDONLY) = -1 ENOENT
close(4) = -1 EBADF

The same pattern repeats later for the render node. The stack (strace -f -k) for the second close is inside libze_intel_gpu, reached from zeInitDrivers through pthread_once in the loader.

Impact: in a multi-threaded process, another thread can be handed the same fd number between the two closes. The driver then closes that thread's file, for example a directory being read by std::fs::remove_dir_all, and that thread fails with EBADF. We hit this as rare, moving test failures in a Rust test binary that runs tests in parallel.

Environment: Arc Pro B70 (8086:e223, PCI 0000:03:00.0), xe kernel driver, Linux 7.3.0, compute runtime 26.40.40196.8 with IGC 2.42.6, gmmlib 22.10.2, Level Zero loader 1.35.0. Reproduced first on 26.27.39122.14 with loader 1.32.0.

Likely cause: the error path after the survivability_mode open fails closes an fd variable that was already closed and not reset to -1.

Workaround on our side: initialise Level Zero once, before other threads start file I/O.

Expected Behavior

Single close

Reproduction Rate

Always reproduces - 100%

Steps to Reproduce

Reproduces with the latest release 26.40.40196.8 (libze_intel_gpu.so.1.18.40196), with 26.27.39122.14, and with the legacy driver libze_intel_gpu_legacy1.so.1.5.30872. zeInitDrivers alone does not do it: 0 bad closes. Adding zesInit gives 2.

openat("/dev/dri/by-path/pci-0000:03:00.0-render", O_RDWR) = 4
close(4) = 0
openat("/sys/class/drm/card0/device/device_uuid") = -1 ENOENT
openat("/sys/bus/pci/drivers/xe", O_DIRECTORY) = 4
close(4) = 0
openat("/sys/bus/pci/drivers/xe/0000:03:00.0/survivability_mode") = -1 ENOENT
close(4) = -1 EBADF        <- fd 4 closed a second time
...
openat("/dev/dri/by-path/pci-0000:03:00.0-render", O_RDWR|O_CLOEXEC) = 4
close(4) = 0
close(4) = -1 EBADF        <- render-node fd closed a second time

Stack of the bad close (strace -k): libc __libc_close <- libze_intel_gpu.so.1.18.40196 +0x8c6412 <- +0x60394d <- +0x5f3994 <- pthread_once <- libze_intel_gpu.so.1.18.40196 +0x29d2eb <- libze_loader.so.1.35.0 loader::zesInit(unsigned int) <- main

gcc repro.c -o repro -lze_loader
gcc repro_race.c -o repro_race -lze_loader -lpthread

Is this a regression?

• Yes, this is a regression - functionality that previously worked is now broken

Last Known Working Driver Version

No response

First Known Failing Driver Version

No response

API Call Logs

No response

strace Logs

No response

System Logs / dmesg Output

No response

Backtrace (if crash or hang occurred)

No response

Source Code / Reproducer

Minimal reproducer, plain C against the Level Zero loader. zesInit() closes a file descriptor it already closed.

/* gcc repro.c -o repro -lze_loader */
#include <stdio.h>
#include <level_zero/ze_api.h>
#include <level_zero/zes_api.h>

int main(void) {
    ze_init_driver_type_desc_t desc = {ZE_STRUCTURE_TYPE_INIT_DRIVER_TYPE_DESC, NULL, ZE_INIT_DRIVER_TYPE_FLAG_GPU};
    uint32_t n = 0;
    ze_result_t r = zeInitDrivers(&n, NULL, &desc);
    printf("zeInitDrivers: 0x%x, %u drivers\n", (unsigned)r, n);
    uint32_t m = 0;
    ze_result_t s = zesInit(0);
    ze_result_t g = zesDriverGet(&m, NULL);
    printf("zesInit: 0x%x, zesDriverGet: 0x%x, %u sysman drivers\n", (unsigned)s, (unsigned)g, m);
    return 0;
}

Expected: no close() returns EBADF. Actual (compute-runtime 26.40.40196.8, Arc Pro B70, xe):

openat(AT_FDCWD, "/sys/bus/pci/drivers/xe", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
close(4)                                = 0
openat(AT_FDCWD, "/sys/bus/pci/drivers/xe/0000:03:00.0/survivability_mode", O_RDONLY) = -1 ENOENT
close(4)                                = -1 EBADF (Bad file descriptor)
...
openat(AT_FDCWD, "/dev/dri/by-path/pci-0000:03:00.0-render", O_RDWR|O_CLOEXEC) = 4
close(4)                                = 0
close(4)                                = -1 EBADF (Bad file descriptor)

Without zesInit (zeInitDrivers only) there is no double close.

Why it matters: in a multithreaded process another thread can be handed the same fd number between the two close() calls, and the driver then closes that thread's file. The attached repro_race.c shows it: one thread loops opendir/readdir/closedir while the main thread calls zeInitDrivers + zesInit. 45 of 200 runs saw EBADF in the other thread, and 0 of 200 without zesInit.

Command Line / Application Details

No response

oneAPI Version (if applicable)

oneAPI Version: Intel(R) oneAPI DPC++/C++ Compiler 2025.3.3 (2025.3.3.20260319). Not needed by the reproducer.

Additional Notes: Our workaround is to initialise Level Zero and Sysman once, before other threads start file I/O.

Screenshots / Video

No response

Additional Notes

No response