diff options
| author | Simon Richter <Simon.Richter@hogyros.de> | 2025-10-14 01:11:33 +0900 |
|---|---|---|
| committer | Matthew Brost <matthew.brost@intel.com> | 2025-12-08 12:07:48 -0800 |
| commit | 491adc6a0f9903c32b05f284df1148de39e8e644 (patch) | |
| tree | bb9b73c598ebeb80f7b1e1380c5c5abeb78b9b1b /drivers/gpu | |
| parent | 979e2ec58de2b600955b8290d1df549e33d67347 (diff) | |
| download | linux-491adc6a0f9903c32b05f284df1148de39e8e644.tar.gz linux-491adc6a0f9903c32b05f284df1148de39e8e644.tar.bz2 linux-491adc6a0f9903c32b05f284df1148de39e8e644.zip | |
drm/ttm: Avoid NULL pointer deref for evicted BOs
It is possible for a BO to exist that is not currently associated with a
resource, e.g. because it has been evicted.
When devcoredump tries to read the contents of all BOs for dumping, we need
to expect this as well -- in this case, ENODATA is recorded instead of the
buffer contents.
Fixes: 7d08df5d0bd3 ("drm/ttm: Add ttm_bo_access")
Fixes: 09ac4fcb3f25 ("drm/ttm: Implement vm_operations_struct.access v2")
Cc: stable <stable@kernel.org>
Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6271
Signed-off-by: Simon Richter <Simon.Richter@hogyros.de>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: Shuicheng Lin <shuicheng.lin@intel.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Matthew Brost <matthew.brost@intel.com>
Link: https://patch.msgid.link/20251013161241.709916-1-Simon.Richter@hogyros.de
Diffstat (limited to 'drivers/gpu')
| -rw-r--r-- | drivers/gpu/drm/ttm/ttm_bo_vm.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c index b47020fca199..e6abc7b40b18 100644 --- a/drivers/gpu/drm/ttm/ttm_bo_vm.c +++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c @@ -434,6 +434,11 @@ int ttm_bo_access(struct ttm_buffer_object *bo, unsigned long offset, if (ret) return ret; + if (!bo->resource) { + ret = -ENODATA; + goto unlock; + } + switch (bo->resource->mem_type) { case TTM_PL_SYSTEM: fallthrough; @@ -448,6 +453,7 @@ int ttm_bo_access(struct ttm_buffer_object *bo, unsigned long offset, ret = -EIO; } +unlock: ttm_bo_unreserve(bo); return ret; |