Re: [PATCH] drm/xe: Handle NULL TTM case in xe_bo_move

[Matthew Auld <matthew.auld@intel.com>]

On 16/09/2025 23:06, Jonathan Cavitt wrote:
> It is possible for xe_bo_move to pass a NULL TTM pointer to
> xe_tt_map_sg, which would result in a NULL pointer dereference.
> Whether or not this issue realistically occurs, it would be good
> to add an error handler to guard agains this.
> 
> Signed-off-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
> ---
>   drivers/gpu/drm/xe/xe_bo.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c
> index 8422f3cab113..bfeae8fd1650 100644
> --- a/drivers/gpu/drm/xe/xe_bo.c
> +++ b/drivers/gpu/drm/xe/xe_bo.c
> @@ -834,7 +834,9 @@ static int xe_bo_move(struct ttm_buffer_object *ttm_bo, bool evict,
>   		(!ttm && ttm_bo->type == ttm_bo_type_device);
>   
>   	if (new_mem->mem_type == XE_PL_TT) {
> -		ret = xe_tt_map_sg(xe, ttm);
> +		ret = -ENOENT;
> +		if (ttm)

When the destination mem_type (new_mem) needs a ttm_tt, like with PL_TT, 
ttm must ensure there is a both a tt attached and that it is populated 
with pages before calling into the driver bo_move(). See 
ttm_bo_handle_move_mem() and the new_use_tt check. If there is no tt or 
it is not populated at this point then that would be a major bug since 
there would be no system memory pages to move to.

If we turn this into a normal error condition and return here the worry 
is that we might then hide this bug instead of crashing early and loudly 
here with NPD.

> +			ret = xe_tt_map_sg(xe, ttm);
>   		if (ret)
>   			goto out;
>   	}