Re: [PATCH v2] drm/xe/vm: Handle purged BOs in VM snapshots

[Matthew Brost <matthew.brost@intel.com>]

On Fri, Sep 04, 2026 at 12:52:52PM +0530, Arvind Yadav wrote:
> A purged BO can remain in a VM after its TTM resource has been freed.
> xe_vm_snapshot_capture() can then dereference a NULL resource while
> capturing a devcoredump.
> 
> Record -ENODATA for the affected VMA instead of dereferencing
> the resource.
> 
> v2:
>  - Read the BO resource once with READ_ONCE(). (Matt)
> 
> Fixes: ad9843aac91a ("drm/xe/madvise: Implement purgeable buffer object support")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://sashiko.dev/#/patchset/20260831064942.315720-17-tejas.upadhyay%40intel.com?part=4
> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
> Cc: Matthew Brost <matthew.brost@intel.com>

I think Sashiko is right this can race with a kfree but that isn't fatal
as this kmalloc slab memory (kernel can just access it) and we only read
(non-destructive if we touch the memory), so worst case is we get the
wrong answer. I think I'd rather sample than deferring to when we can
take the lock as we are more likely to get the right answer if memory is
moving.

So accepting the race:

Reviewed-by: Matthew Brost <matthew.brost@intel.com>

> Signed-off-by: Arvind Yadav <arvind.yadav@intel.com>
> ---
>  drivers/gpu/drm/xe/xe_vm.c | 31 ++++++++++++++++++++-----------
>  1 file changed, 20 insertions(+), 11 deletions(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c
> index 19b3d0be7928..fcdd34c4f0fa 100644
> --- a/drivers/gpu/drm/xe/xe_vm.c
> +++ b/drivers/gpu/drm/xe/xe_vm.c
> @@ -4663,20 +4663,29 @@ struct xe_vm_snapshot *xe_vm_snapshot_capture(struct xe_vm *vm)
>  			XE_VM_SNAP_FLAG_READ_ONLY : 0;
>  		snap->snap[i].pat_index = vma->attr.pat_index;
>  		if (bo) {
> +			struct ttm_resource *res;
> +
>  			snap->snap[i].cpu_caching = bo->cpu_caching;
>  			snap->snap[i].bo = xe_bo_get(bo);
>  			snap->snap[i].bo_ofs = xe_vma_bo_offset(vma);
> -			switch (bo->ttm.resource->mem_type) {
> -			case XE_PL_SYSTEM:
> -			case XE_PL_TT:
> -				snap->snap[i].uapi_mem_region = 0;
> -				break;
> -			case XE_PL_VRAM0:
> -				snap->snap[i].uapi_mem_region = 1;
> -				break;
> -			case XE_PL_VRAM1:
> -				snap->snap[i].uapi_mem_region = 2;
> -				break;
> +			snap->snap[i].uapi_mem_region = -1;
> +
> +			res = READ_ONCE(bo->ttm.resource);
> +			if (!res) {
> +				snap->snap[i].data = ERR_PTR(-ENODATA);
> +			} else {
> +				switch (res->mem_type) {
> +				case XE_PL_SYSTEM:
> +				case XE_PL_TT:
> +					snap->snap[i].uapi_mem_region = 0;
> +					break;
> +				case XE_PL_VRAM0:
> +					snap->snap[i].uapi_mem_region = 1;
> +					break;
> +				case XE_PL_VRAM1:
> +					snap->snap[i].uapi_mem_region = 2;
> +					break;
> +				}
>  			}
>  		} else if (xe_vma_is_userptr(vma)) {
>  			struct mm_struct *mm =
> -- 
> 2.43.0
>