Commit 491adc6a authored Oct 14, 2025 by Simon Richter Committed by Matthew Brost Dec 08, 2025

drm/ttm: Avoid NULL pointer deref for evicted BOs

It is possible for a BO to exist that is not currently associated with a
resource, e.g. because it has been evicted.

When devcoredump tries to read the contents of all BOs for dumping, we need
to expect this as well -- in this case, ENODATA is recorded instead of the
buffer contents.

Fixes: 7d08df5d ("drm/ttm: Add ttm_bo_access")
Fixes: 09ac4fcb ("drm/ttm: Implement vm_operations_struct.access v2")
Cc: stable <stable@kernel.org>
Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6271


Signed-off-by: Simon Richter <Simon.Richter@hogyros.de>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: Shuicheng Lin <shuicheng.lin@intel.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Matthew Brost <matthew.brost@intel.com>
Link: https://patch.msgid.link/20251013161241.709916-1-Simon.Richter@hogyros.de

parent 979e2ec5

drivers/gpu/drm/ttm/ttm_bo_vm.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -434,6 +434,11 @@ int ttm_bo_access(struct ttm_buffer_object *bo, unsigned long offset,
		if (ret)
		return ret;

		if (!bo->resource) {
		ret = -ENODATA;
		goto unlock;
		}

		switch (bo->resource->mem_type) {
		case TTM_PL_SYSTEM:
		fallthrough;
		@@ -448,6 +453,7 @@ int ttm_bo_access(struct ttm_buffer_object *bo, unsigned long offset,
		ret = -EIO;
		}

		unlock:
		ttm_bo_unreserve(bo);

		return ret;