[PATCH v2] drm/xe/vm: Handle purged BOs in VM snapshots

[Arvind Yadav <arvind.yadav@intel.com>]

A purged BO can remain in a VM after its TTM resource has been freed.
xe_vm_snapshot_capture() can then dereference a NULL resource while
capturing a devcoredump.

Record -ENODATA for the affected VMA instead of dereferencing
the resource.

v2:
 - Read the BO resource once with READ_ONCE(). (Matt)

Fixes: ad9843aac91a ("drm/xe/madvise: Implement purgeable buffer object support")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260831064942.315720-17-tejas.upadhyay%40intel.com?part=4
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Signed-off-by: Arvind Yadav <arvind.yadav@intel.com>
---
 drivers/gpu/drm/xe/xe_vm.c | 31 ++++++++++++++++++++-----------
 1 file changed, 20 insertions(+), 11 deletions(-)

diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c
index 19b3d0be7928..fcdd34c4f0fa 100644
--- a/drivers/gpu/drm/xe/xe_vm.c
+++ b/drivers/gpu/drm/xe/xe_vm.c
@@ -4663,20 +4663,29 @@ struct xe_vm_snapshot *xe_vm_snapshot_capture(struct xe_vm *vm)
 			XE_VM_SNAP_FLAG_READ_ONLY : 0;
 		snap->snap[i].pat_index = vma->attr.pat_index;
 		if (bo) {
+			struct ttm_resource *res;
+
 			snap->snap[i].cpu_caching = bo->cpu_caching;
 			snap->snap[i].bo = xe_bo_get(bo);
 			snap->snap[i].bo_ofs = xe_vma_bo_offset(vma);
-			switch (bo->ttm.resource->mem_type) {
-			case XE_PL_SYSTEM:
-			case XE_PL_TT:
-				snap->snap[i].uapi_mem_region = 0;
-				break;
-			case XE_PL_VRAM0:
-				snap->snap[i].uapi_mem_region = 1;
-				break;
-			case XE_PL_VRAM1:
-				snap->snap[i].uapi_mem_region = 2;
-				break;
+			snap->snap[i].uapi_mem_region = -1;
+
+			res = READ_ONCE(bo->ttm.resource);
+			if (!res) {
+				snap->snap[i].data = ERR_PTR(-ENODATA);
+			} else {
+				switch (res->mem_type) {
+				case XE_PL_SYSTEM:
+				case XE_PL_TT:
+					snap->snap[i].uapi_mem_region = 0;
+					break;
+				case XE_PL_VRAM0:
+					snap->snap[i].uapi_mem_region = 1;
+					break;
+				case XE_PL_VRAM1:
+					snap->snap[i].uapi_mem_region = 2;
+					break;
+				}
 			}
 		} else if (xe_vma_is_userptr(vma)) {
 			struct mm_struct *mm =
-- 
2.43.0