[PATCH v2] drm/ttm: return an error when kmapping a BO without pages

[PATCH v2] drm/ttm: return an error when kmapping a BO without pages

[Jesse Zhang]

ttm_tt objects for imported sg tables (ttm_bo_type_sg, set up by
ttm_sg_tt_init() with TTM_TT_FLAG_EXTERNAL) only have DMA addresses and
no pages array. ttm_bo_kmap() and ttm_bo_vmap() still dereference
ttm->pages for them, so a driver that tries to CPU map such a BO oopses
instead of getting an error:

  BUG: kernel NULL pointer dereference, address: 0000000000000000
  RIP: 0010:ttm_bo_kmap+0x26c/0x300 [ttm]
  Call Trace:
   amdgpu_bo_kmap+0x89/0xb0 [amdgpu]
   amdgpu_userq_fence_read_wptr+0x116/0x170 [amdgpu]
   amdgpu_userq_signal_ioctl+0x3fe/0xbb0 [amdgpu]

Return -EINVAL in that case, like ttm_bo_kmap_try_from_panic() already
checks for a missing pages array.

Fixes: 75a57669cbc8 ("drm/ttm: add ttm_sg_tt_init")
Cc: stable@vger.kernel.org
Suggested-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
---
 drivers/gpu/drm/ttm/ttm_bo_util.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index 3e3c201a0222..83142bfa3bc1 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -356,6 +356,10 @@ static int ttm_bo_kmap_ttm(struct ttm_buffer_object *bo,
 	if (ret)
 		return ret;
 
+	/* Imported sg tables only come with DMA addresses, no pages to map. */
+	if (!ttm->pages)
+		return -EINVAL;
+
 	if (num_pages == 1 && ttm->caching == ttm_cached &&
 	    !(man->use_tt && (ttm->page_flags & TTM_TT_FLAG_DECRYPTED))) {
 		/*
@@ -419,7 +423,7 @@ EXPORT_SYMBOL(ttm_bo_kmap_try_from_panic);
  *
  * Returns
  * -ENOMEM: Out of memory.
- * -EINVAL: Invalid range.
+ * -EINVAL: Invalid range or the BO has no pages to map.
  */
 int ttm_bo_kmap(struct ttm_buffer_object *bo,
 		unsigned long start_page, unsigned long num_pages,
@@ -493,7 +497,7 @@ EXPORT_SYMBOL(ttm_bo_kunmap);
  *
  * Returns
  * -ENOMEM: Out of memory.
- * -EINVAL: Invalid range.
+ * -EINVAL: Invalid range or the BO has no pages to map.
  */
 int ttm_bo_vmap(struct ttm_buffer_object *bo, struct iosys_map *map)
 {
@@ -537,6 +541,9 @@ int ttm_bo_vmap(struct ttm_buffer_object *bo, struct iosys_map *map)
 		if (ret)
 			return ret;
 
+		if (!ttm->pages)
+			return -EINVAL;
+
 		/*
 		 * We need to use vmap to get the desired page protection
 		 * or to make the buffer object look contiguous.
-- 
2.50.1

Re: [PATCH v2] drm/ttm: return an error when kmapping a BO without pages

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] ttm: NULL pointer dereference in CPU fault and memcpy fallbacks for SG BOs
--

commit ba111d71d680811150fde6d535fc740c46cc9d63
Author: Jesse Zhang <Jesse.Zhang@amd.com>

drm/ttm: return an error when kmapping a BO without pages

This commit adds checks to return an error when attempting to kmap or vmap a
buffer object that lacks a pages array, which occurs with imported SG tables.

> diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
> index bd0b23ac2cc4b..f9458a4d5a09d 100644
> --- a/drivers/gpu/drm/ttm/ttm_bo_util.c
> +++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
> @@ -356,6 +356,10 @@ static int ttm_bo_kmap_ttm(struct ttm_buffer_object *bo,
>  	if (ret)
>  		return ret;
>  
> +	/* Imported sg tables only come with DMA addresses, no pages to map. */
> +	if (!ttm->pages)
> +		return -EINVAL;
> +

[Severity: High]
While this handles the kmap and vmap paths, can a similar NULL pointer
dereference occur in the CPU fault path and memcpy fallback for SG BOs?

If an imported BO is mapped via the DRM fd, userspace page faults can reach
ttm_bo_vm_fault_reserved(), which unconditionally dereferences ttm->pages:

drivers/gpu/drm/ttm/ttm_bo_vm.c:ttm_bo_vm_fault_reserved() {
    ...
    page = ttm->pages[page_offset];
    if (unlikely(!page && i == 0)) {
    ...
}

Similarly, if hardware copies fail on an imported BO and it falls back to
ttm_bo_move_memcpy(), the TT iterator initialized there is later used in
ttm_kmap_iter_tt_map_local(), which also accesses the pages array:

drivers/gpu/drm/ttm/ttm_bo_util.c:ttm_bo_move_memcpy() {
    ...
    dst_iter = ttm_kmap_iter_tt_init(&_dst_iter.tt, ttm);
    ...
}

drivers/gpu/drm/ttm/ttm_tt.c:ttm_kmap_iter_tt_map_local() {
    ...
    iosys_map_set_vaddr(dmap, kmap_local_page_prot(iter_tt->tt->pages[i],
                                                   iter_tt->prot));
    ...
}

Do these paths also need to check for a missing pages array and return an
error to prevent a crash?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261009103419.4122940-1-Jesse.Zhang@amd.com?part=1

Re: [PATCH v2] drm/ttm: return an error when kmapping a BO without pages

[Arunpravin Paneer Selvam]

On 10/9/2026 4:03 PM, Jesse Zhang wrote:
> ttm_tt objects for imported sg tables (ttm_bo_type_sg, set up by
> ttm_sg_tt_init() with TTM_TT_FLAG_EXTERNAL) only have DMA addresses and
> no pages array. ttm_bo_kmap() and ttm_bo_vmap() still dereference
> ttm->pages for them, so a driver that tries to CPU map such a BO oopses
> instead of getting an error:
>
>    BUG: kernel NULL pointer dereference, address: 0000000000000000
>    RIP: 0010:ttm_bo_kmap+0x26c/0x300 [ttm]
>    Call Trace:
>     amdgpu_bo_kmap+0x89/0xb0 [amdgpu]
>     amdgpu_userq_fence_read_wptr+0x116/0x170 [amdgpu]
>     amdgpu_userq_signal_ioctl+0x3fe/0xbb0 [amdgpu]
>
> Return -EINVAL in that case, like ttm_bo_kmap_try_from_panic() already
> checks for a missing pages array.
>
> Fixes: 75a57669cbc8 ("drm/ttm: add ttm_sg_tt_init")
> Cc: stable@vger.kernel.org
> Suggested-by: Christian König <christian.koenig@amd.com>
> Reviewed-by: Christian König <christian.koenig@amd.com>
> Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
I have upstreamed this patch.

Regards,
Arun.
> ---
>   drivers/gpu/drm/ttm/ttm_bo_util.c | 11 +++++++++--
>   1 file changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
> index 3e3c201a0222..83142bfa3bc1 100644
> --- a/drivers/gpu/drm/ttm/ttm_bo_util.c
> +++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
> @@ -356,6 +356,10 @@ static int ttm_bo_kmap_ttm(struct ttm_buffer_object *bo,
>   	if (ret)
>   		return ret;
>   
> +	/* Imported sg tables only come with DMA addresses, no pages to map. */
> +	if (!ttm->pages)
> +		return -EINVAL;
> +
>   	if (num_pages == 1 && ttm->caching == ttm_cached &&
>   	    !(man->use_tt && (ttm->page_flags & TTM_TT_FLAG_DECRYPTED))) {
>   		/*
> @@ -419,7 +423,7 @@ EXPORT_SYMBOL(ttm_bo_kmap_try_from_panic);
>    *
>    * Returns
>    * -ENOMEM: Out of memory.
> - * -EINVAL: Invalid range.
> + * -EINVAL: Invalid range or the BO has no pages to map.
>    */
>   int ttm_bo_kmap(struct ttm_buffer_object *bo,
>   		unsigned long start_page, unsigned long num_pages,
> @@ -493,7 +497,7 @@ EXPORT_SYMBOL(ttm_bo_kunmap);
>    *
>    * Returns
>    * -ENOMEM: Out of memory.
> - * -EINVAL: Invalid range.
> + * -EINVAL: Invalid range or the BO has no pages to map.
>    */
>   int ttm_bo_vmap(struct ttm_buffer_object *bo, struct iosys_map *map)
>   {
> @@ -537,6 +541,9 @@ int ttm_bo_vmap(struct ttm_buffer_object *bo, struct iosys_map *map)
>   		if (ret)
>   			return ret;
>   
> +		if (!ttm->pages)
> +			return -EINVAL;
> +
>   		/*
>   		 * We need to use vmap to get the desired page protection
>   		 * or to make the buffer object look contiguous.