Re: [PATCH v5 02/25] drm/xe: Add xe_migrate_update_pgtables_cpu_execute helper

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] Defective sanity checks and unhandled null pointer dereference in debug assertions
--

commit e58d5ab50ce62f929a498f3193e4a6ff719f485b
Author: Matthew Brost <matthew.brost@intel.com>

drm/xe: Add xe_migrate_update_pgtables_cpu_execute helper

This commit adds the xe_migrate_update_pgtables_cpu_execute helper to perform
CPU-side page-table updates, supporting CPU binds. It extracts the logic from
xe_migrate_update_pgtables_cpu and adds basic sanity check assertions on the
function arguments.

Link: https://patch.msgid.link/20260228013501.106680-3-matthew.brost@intel.com

> diff --git a/drivers/gpu/drm/xe/xe_migrate.c b/drivers/gpu/drm/xe/xe_migrate.c
> index 149c5fa654e67..68a0b05f56ec9 100644
> --- a/drivers/gpu/drm/xe/xe_migrate.c
> +++ b/drivers/gpu/drm/xe/xe_migrate.c
> @@ -1819,6 +1819,38 @@ struct migrate_test_params {
>  	container_of(_priv, struct migrate_test_params, base)
>  #endif
>  
> +static void
> +xe_migrate_update_pgtables_cpu_execute(struct xe_vm *vm, struct xe_tile *tile,
> +				       const struct xe_migrate_pt_update_ops *ops,
> +				       struct xe_vm_pgtable_update_op *pt_op,
> +				       u32 num_ops)
> +{
> +	u32 j, i;
> +
> +	for (j = 0; j < num_ops; ++j, ++pt_op) {
> +		for (i = 0; i < pt_op->num_entries; i++) {
> +			const struct xe_vm_pgtable_update *update =
> +				&pt_op->entries[i];
> +
> +			xe_tile_assert(tile, update);
> +			xe_tile_assert(tile, update->pt_bo);
> +			xe_tile_assert(tile, !iosys_map_is_null(&update->pt_bo->vmap));

[Severity: Low]
Are these assertions operating as intended in
xe_migrate_update_pgtables_cpu_execute?

Because update is assigned the address of an array element, checking update
in xe_tile_assert is a tautology and will always evaluate to true.

Additionally, in the triggering condition where update->pt_bo is actually
NULL, the third assertion passes the address of vmap to iosys_map_is_null.
Since vmap is an offset from NULL, iosys_map_is_null will dereference an
invalid pointer when checking the is_iomem flag. This causes an immediate
kernel page fault rather than allowing the assertion to safely log a warning
and continue execution.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260904022207.3490018-1-matthew.brost@intel.com?part=2