Re: [V2] drm/xe: Skip clearing purged page-table BOs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Incomplete fix leaving a NULL pointer dereference on the purge failure path.
--

commit 7b05185667ad1f435ac6e264d5925cdea78caa91
Author: Tejas Upadhyay <tejas.upadhyay@intel.com>

drm/xe: Skip clearing purged page-table BOs

This commit attempts to prevent accessing cleared vmaps during VM teardown 
by checking if the buffer object is purged before calling xe_map_memset().

> diff --git a/drivers/gpu/drm/xe/xe_pt.c b/drivers/gpu/drm/xe/xe_pt.c
> index 5d990c1c3740a..a9b9cd7ac2c87 100644
> --- a/drivers/gpu/drm/xe/xe_pt.c
> +++ b/drivers/gpu/drm/xe/xe_pt.c
[ ... ]
> @@ -236,9 +236,11 @@ void xe_pt_destroy(struct xe_pt *pt, u32 flags, struct llist_head *deferred)
>  */
> void xe_pt_clear(struct xe_device *xe, struct xe_pt *pt)
> {
> -	struct iosys_map *map = &pt->bo->vmap;
> +	struct xe_bo *bo = pt->bo;
> 
> -	xe_map_memset(xe, map, 0, 0, SZ_4K);
> +	xe_bo_assert_held(bo);
> +	if (!xe_bo_is_purged(bo))
> +		xe_map_memset(xe, &bo->vmap, 0, 0, SZ_4K);

[Severity: High]
This isn't a bug introduced by this patch, but does this incomplete fix still
leave a NULL pointer dereference if the purge operation fails?

If a VRAM fault triggers xe_ttm_vram_purge_page() on a root page table BO,
the sequence first unmaps the virtual mapping before attempting the purge:

xe_ttm_vram_mgr.c:xe_ttm_vram_purge_page() {
    ...
    xe_bo_set_purgeable_state(bo, XE_MADV_PURGEABLE_DONTNEED);
    ttm_bo_unmap_virtual(&bo->ttm);   /* nuke CPU mmap + VRAM IO mappings */
    if (xe_bo_is_pinned(bo))
        xe_bo_unpin(bo);
    ret = xe_ttm_bo_purge(&bo->ttm, &ctx);
    ...
}

During the ttm_bo_unmap_virtual() sequence, bo->vmap is cleared. If
xe_ttm_bo_purge() subsequently fails (for example, due to a memory allocation
failure in ttm_bo_validate()), the BO remains in the DONTNEED state rather
than becoming PURGED.

Later, when xe_vm_close() calls xe_pt_clear(), this newly added check
(!xe_bo_is_purged(bo)) will evaluate to true because the BO is only in the
DONTNEED state, not PURGED.

Could xe_map_memset() then be called with the cleared (NULL) bo->vmap,
causing a crash?

Would it be safer to explicitly guard against cleared mappings by checking
!iosys_map_is_null(&bo->vmap) here instead?

> }
> 
> /**

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260907153706.888679-2-tejas.upadhyay@intel.com?part=1