Re: [PATCH V19 04/15] drm/xe: Handle NULL resource and allow purging of VRAM pages

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Kernel crash in xe_vm_snapshot_capture() when capturing a VM containing a purged BO.
--

commit 695b3991e4560b777497e2ae90e478f459a620d0
Author: Tejas Upadhyay <tejas.upadhyay@intel.com>

drm/xe: Handle NULL resource and allow purging of VRAM pages

This commit adds NULL checks for the buffer object's resource pointer in
xe_bo_is_vram() and xe_bo_is_stolen(). It also removes the check that
prevented purging when ttm_bo->ttm is NULL from xe_ttm_bo_purge(),
explicitly allowing VRAM pages to be purged during memory page offlining.

> diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c
> index 8f93e09e51bb8..d30a8411d2a33 100644
> --- a/drivers/gpu/drm/xe/xe_bo.c
> +++ b/drivers/gpu/drm/xe/xe_bo.c
[ ... ]
> @@ -929,9 +932,6 @@ int xe_ttm_bo_purge(struct ttm_buffer_object *ttm_bo, struct ttm_operation_ctx *
>  
>  	xe_bo_assert_held(bo);
>  
> -	if (!ttm_bo->ttm)
> -		return 0;
> -

[Severity: High]
This is a pre-existing issue, but now that this patch series enables purging
for VRAM BOs, does this expose a kernel panic during devcoredump capture?

When a BO is marked DONTNEED and purged, its ttm.resource is freed and set
to NULL. If a GPU hang later occurs in the VM where this purged BO is still
mapped, the devcoredump handler in xe_vm_snapshot_capture() iterates over
the VM's VMAs and accesses the memory type unconditionally:

drivers/gpu/drm/xe/xe_vm.c:xe_vm_snapshot_capture() {
    ...
            switch (bo->ttm.resource->mem_type) {
            case XE_PL_SYSTEM:
    ...
}

Because bo->ttm.resource is NULL for purged BOs, this causes a NULL pointer
dereference and crashes the kernel. This can potentially be triggered by
unprivileged userspace to cause a Denial of Service. 

Could we add a NULL check in xe_vm_snapshot_capture() before attempting to
access mem_type, similar to the defensive checks added to xe_bo_is_vram()
in this patch?

>  	if (!xe_bo_madv_is_dontneed(bo))
>  		return 0;
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831064942.315720-17-tejas.upadhyay@intel.com?part=4