Re: [PATCH V20 04/15] drm/xe: Handle NULL resource and allow purging of VRAM pages

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Null pointer dereference in `xe_vm_snapshot_capture` when capturing a VM containing a purged BO.
--

commit f809a0c4f30d1158f4546c8b29fd7d07fc7912ae
Author: Tejas Upadhyay <tejas.upadhyay@intel.com>

drm/xe: Handle NULL resource and allow purging of VRAM pages

This patch adds NULL checks for the buffer object's resource pointer in
xe_bo_is_vram() and xe_bo_is_stolen() to prevent potential NULL pointer
dereferences. It also removes the restriction in xe_ttm_bo_purge() to
explicitly allow the driver to purge VRAM pages.

> diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c
> index 8f93e09e51bb8..d30a8411d2a33 100644
> --- a/drivers/gpu/drm/xe/xe_bo.c
> +++ b/drivers/gpu/drm/xe/xe_bo.c
[ ... ]
> @@ -929,9 +932,6 @@ int xe_ttm_bo_purge(struct ttm_buffer_object *ttm_bo, struct ttm_operation_ctx *
>  
>  	xe_bo_assert_held(bo);
>  
> -	if (!ttm_bo->ttm)
> -		return 0;
> -

[Severity: High]
This is a pre-existing issue, but by removing this check to allow VRAM pages
to be purged, does it expose a NULL pointer dereference in
xe_vm_snapshot_capture()?

If a BO mapped in a VM with the XE_VMA_DUMPABLE flag is purged (e.g., via
VRAM page offlining or memory pressure after being marked DONTNEED), its
backing store is freed and bo->ttm.resource is set to NULL.

If a GPU hang subsequently triggers a devcoredump, xe_vm_snapshot_capture()
iterates over the VMAs and unconditionally dereferences bo->ttm.resource
without holding the BO's dma-resv lock or checking for NULL:

drivers/gpu/drm/xe/xe_vm.c:xe_vm_snapshot_capture() {
    ...
    if (bo) {
        snap->snap[i].cpu_caching = bo->cpu_caching;
        snap->snap[i].bo = xe_bo_get(bo);
        snap->snap[i].bo_ofs = xe_vma_bo_offset(vma);
        switch (bo->ttm.resource->mem_type) {
    ...
}

Could this cause a kernel panic if a local user marks a dumpable BO as
DONTNEED, waits for it to be purged, and then intentionally hangs the GPU?

>  	if (!xe_bo_madv_is_dontneed(bo))
>  		return 0;
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260902145343.465686-17-tejas.upadhyay@intel.com?part=4