* [PATCH] drm/ttm: Account for NULL and handle pages in ttm_pool_backup
@ 2026-07-02 21:48 Matthew Brost
2026-07-14 18:33 ` Thomas Hellström
0 siblings, 1 reply; 2+ messages in thread
From: Matthew Brost @ 2026-07-02 21:48 UTC (permalink / raw)
To: intel-xe, dri-devel
Cc: Christian Koenig, Huang Rui, Matthew Auld, Maarten Lankhorst,
Maxime Ripard, Thomas Zimmermann, David Airlie, Simona Vetter,
Thomas Hellström, linux-kernel, stable
Pages in ttm_pool_backup can be NULL or backup handles
(ttm_backup_page_ptr_is_handle()), neither of which can be passed to
set_pages_array_wb() or freed. Add a dedicated WB pass before the
dma/purge loop that walks allocations using the same i += num_pages
stride, skipping NULL and handle entries, and calls set_pages_array_wb()
once per contiguous run of real pages. Apply the same NULL/handle guard
to the dma/purge loop.
Fixes the following oops:
Oops: general protection fault, kernel NULL pointer dereference 0x0: 0000 [#1] SMP NOPTI
RIP: 0010:__cpa_process_fault+0xf8/0x770
RSP: 0018:ffffc90000a87718 EFLAGS: 00010287
RAX: 0000000000000000 RBX: ffffc90000a87868 RCX: 0000000000000000
RDX: 0000000000001000 RSI: 0005088000000000 RDI: ffffffff827c5f34
RBP: 0005088000000000 R08: ffffc90000a877cb R09: ffffc90000a877d0
R10: 0000000000000000 R11: 000000000000001b R12: 000ffffffffff000
R13: ffffc90000a87868 R14: ffffc90000a87868 R15: ffff88815b882ae0
FS: 0000000000000000(0000) GS:ffff8884ec840000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f930b844000 CR3: 000000000262e003 CR4: 0000000008f70ef0
PKRU: 55555554
Call Trace:
<TASK>
__change_page_attr_set_clr+0x989/0xe90
? __purge_vmap_area_lazy+0x6c/0x3a0
? _vm_unmap_aliases+0x250/0x2a0
set_pages_array_wb+0x7f/0x120
ttm_pool_backup+0x4c9/0x5b0 [ttm]
? dma_resv_wait_timeout+0x3b/0xf0
ttm_tt_backup+0x32/0x60 [ttm]
ttm_bo_shrink+0x66/0x110 [ttm]
xe_bo_shrink_purge+0x12b/0x1b0 [xe]
xe_bo_shrink+0xbb/0x270 [xe]
__xe_shrinker_walk+0xf7/0x160 [xe]
xe_shrinker_walk+0x9d/0xc0 [xe]
xe_shrinker_scan+0x11f/0x210 [xe]
do_shrink_slab+0x13b/0x270
shrink_slab+0xf1/0x400
shrink_node+0x352/0x8a0
balance_pgdat+0x32c/0x700
kswapd+0x205/0x2f0
? __pfx_autoremove_wake_function+0x10/0x10
? __pfx_kswapd+0x10/0x10
kthread+0xd1/0x110
? __pfx_kthread+0x10/0x10
ret_from_fork+0x1b1/0x200
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
Cc: Christian Koenig <christian.koenig@amd.com>
Cc: Huang Rui <ray.huang@amd.com>
Cc: Matthew Auld <matthew.auld@intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: David Airlie <airlied@gmail.com>
Cc: Simona Vetter <simona@ffwll.ch>
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Cc: dri-devel@lists.freedesktop.org
Cc: linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org
Fixes: b63d715b8090 ("drm/ttm/pool, drm/ttm/tt: Provide a helper to shrink pages")
Cc: stable@vger.kernel.org
Assisted-by: GitHub_Copilot:claude-opus-4.8
Signed-off-by: Matthew Brost <matthew.brost@intel.com>
---
drivers/gpu/drm/ttm/ttm_pool.c | 30 ++++++++++++++++++++++++++----
1 file changed, 26 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/ttm/ttm_pool.c b/drivers/gpu/drm/ttm/ttm_pool.c
index 3d5f2ae0a456..ff043420d517 100644
--- a/drivers/gpu/drm/ttm/ttm_pool.c
+++ b/drivers/gpu/drm/ttm/ttm_pool.c
@@ -1065,9 +1065,31 @@ long ttm_pool_backup(struct ttm_pool *pool, struct ttm_tt *tt,
return -EBUSY;
#ifdef CONFIG_X86
- /* Anything returned to the system needs to be cached. */
- if (tt->caching != ttm_cached)
- set_pages_array_wb(tt->pages, tt->num_pages);
+ /* Anything returned to the system needs to be cached. Walk allocations
+ * skipping NULL pages and issue set_pages_array_wb() per contiguous run.
+ */
+ if (tt->caching != ttm_cached) {
+ pgoff_t run_start = 0, run_count = 0;
+
+ for (i = 0; i < tt->num_pages; i += num_pages) {
+ page = tt->pages[i];
+ if (unlikely(!page || ttm_backup_page_ptr_is_handle(page))) {
+ if (run_count) {
+ set_pages_array_wb(&tt->pages[run_start],
+ run_count);
+ run_count = 0;
+ }
+ num_pages = 1;
+ continue;
+ }
+ num_pages = 1UL << ttm_pool_page_order(pool, page);
+ if (!run_count)
+ run_start = i;
+ run_count += num_pages;
+ }
+ if (run_count)
+ set_pages_array_wb(&tt->pages[run_start], run_count);
+ }
#endif
if (tt->dma_address || flags->purge) {
@@ -1075,7 +1097,7 @@ long ttm_pool_backup(struct ttm_pool *pool, struct ttm_tt *tt,
unsigned int order;
page = tt->pages[i];
- if (unlikely(!page)) {
+ if (unlikely(!page || ttm_backup_page_ptr_is_handle(page))) {
num_pages = 1;
continue;
}
--
2.34.1
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] drm/ttm: Account for NULL and handle pages in ttm_pool_backup
2026-07-02 21:48 [PATCH] drm/ttm: Account for NULL and handle pages in ttm_pool_backup Matthew Brost
@ 2026-07-14 18:33 ` Thomas Hellström
0 siblings, 0 replies; 2+ messages in thread
From: Thomas Hellström @ 2026-07-14 18:33 UTC (permalink / raw)
To: Matthew Brost, intel-xe, dri-devel
Cc: Christian Koenig, Huang Rui, Matthew Auld, Maarten Lankhorst,
Maxime Ripard, Thomas Zimmermann, David Airlie, Simona Vetter,
linux-kernel, stable
On Thu, 2026-07-02 at 14:48 -0700, Matthew Brost wrote:
> Pages in ttm_pool_backup can be NULL or backup handles
> (ttm_backup_page_ptr_is_handle()), neither of which can be passed to
> set_pages_array_wb() or freed. Add a dedicated WB pass before the
> dma/purge loop that walks allocations using the same i += num_pages
> stride, skipping NULL and handle entries, and calls
> set_pages_array_wb()
> once per contiguous run of real pages. Apply the same NULL/handle
> guard
> to the dma/purge loop.
>
> Fixes the following oops:
>
> Oops: general protection fault, kernel NULL pointer dereference 0x0:
> 0000 [#1] SMP NOPTI
> RIP: 0010:__cpa_process_fault+0xf8/0x770
> RSP: 0018:ffffc90000a87718 EFLAGS: 00010287
> RAX: 0000000000000000 RBX: ffffc90000a87868 RCX: 0000000000000000
> RDX: 0000000000001000 RSI: 0005088000000000 RDI: ffffffff827c5f34
> RBP: 0005088000000000 R08: ffffc90000a877cb R09: ffffc90000a877d0
> R10: 0000000000000000 R11: 000000000000001b R12: 000ffffffffff000
> R13: ffffc90000a87868 R14: ffffc90000a87868 R15: ffff88815b882ae0
> FS: 0000000000000000(0000) GS:ffff8884ec840000(0000)
> knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f930b844000 CR3: 000000000262e003 CR4: 0000000008f70ef0
> PKRU: 55555554
> Call Trace:
> <TASK>
> __change_page_attr_set_clr+0x989/0xe90
> ? __purge_vmap_area_lazy+0x6c/0x3a0
> ? _vm_unmap_aliases+0x250/0x2a0
> set_pages_array_wb+0x7f/0x120
> ttm_pool_backup+0x4c9/0x5b0 [ttm]
> ? dma_resv_wait_timeout+0x3b/0xf0
> ttm_tt_backup+0x32/0x60 [ttm]
> ttm_bo_shrink+0x66/0x110 [ttm]
> xe_bo_shrink_purge+0x12b/0x1b0 [xe]
> xe_bo_shrink+0xbb/0x270 [xe]
> __xe_shrinker_walk+0xf7/0x160 [xe]
> xe_shrinker_walk+0x9d/0xc0 [xe]
> xe_shrinker_scan+0x11f/0x210 [xe]
> do_shrink_slab+0x13b/0x270
> shrink_slab+0xf1/0x400
> shrink_node+0x352/0x8a0
> balance_pgdat+0x32c/0x700
> kswapd+0x205/0x2f0
> ? __pfx_autoremove_wake_function+0x10/0x10
> ? __pfx_kswapd+0x10/0x10
> kthread+0xd1/0x110
> ? __pfx_kthread+0x10/0x10
> ret_from_fork+0x1b1/0x200
> ? __pfx_kthread+0x10/0x10
> ret_from_fork_asm+0x1a/0x30
> </TASK>
>
> Cc: Christian Koenig <christian.koenig@amd.com>
> Cc: Huang Rui <ray.huang@amd.com>
> Cc: Matthew Auld <matthew.auld@intel.com>
> Cc: Matthew Brost <matthew.brost@intel.com>
> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
> Cc: Maxime Ripard <mripard@kernel.org>
> Cc: Thomas Zimmermann <tzimmermann@suse.de>
> Cc: David Airlie <airlied@gmail.com>
> Cc: Simona Vetter <simona@ffwll.ch>
> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> Cc: dri-devel@lists.freedesktop.org
> Cc: linux-kernel@vger.kernel.org
> Cc: stable@vger.kernel.org
> Fixes: b63d715b8090 ("drm/ttm/pool, drm/ttm/tt: Provide a helper to
> shrink pages")
> Cc: stable@vger.kernel.org
> Assisted-by: GitHub_Copilot:claude-opus-4.8
> Signed-off-by: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> ---
> drivers/gpu/drm/ttm/ttm_pool.c | 30 ++++++++++++++++++++++++++----
> 1 file changed, 26 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/ttm/ttm_pool.c
> b/drivers/gpu/drm/ttm/ttm_pool.c
> index 3d5f2ae0a456..ff043420d517 100644
> --- a/drivers/gpu/drm/ttm/ttm_pool.c
> +++ b/drivers/gpu/drm/ttm/ttm_pool.c
> @@ -1065,9 +1065,31 @@ long ttm_pool_backup(struct ttm_pool *pool,
> struct ttm_tt *tt,
> return -EBUSY;
>
> #ifdef CONFIG_X86
> - /* Anything returned to the system needs to be cached. */
> - if (tt->caching != ttm_cached)
> - set_pages_array_wb(tt->pages, tt->num_pages);
> + /* Anything returned to the system needs to be cached. Walk
> allocations
> + * skipping NULL pages and issue set_pages_array_wb() per
> contiguous run.
> + */
> + if (tt->caching != ttm_cached) {
> + pgoff_t run_start = 0, run_count = 0;
> +
> + for (i = 0; i < tt->num_pages; i += num_pages) {
> + page = tt->pages[i];
> + if (unlikely(!page ||
> ttm_backup_page_ptr_is_handle(page))) {
> + if (run_count) {
> + set_pages_array_wb(&tt-
> >pages[run_start],
> +
> run_count);
> + run_count = 0;
> + }
> + num_pages = 1;
> + continue;
> + }
> + num_pages = 1UL << ttm_pool_page_order(pool,
> page);
> + if (!run_count)
> + run_start = i;
> + run_count += num_pages;
> + }
> + if (run_count)
> + set_pages_array_wb(&tt->pages[run_start],
> run_count);
> + }
> #endif
>
> if (tt->dma_address || flags->purge) {
> @@ -1075,7 +1097,7 @@ long ttm_pool_backup(struct ttm_pool *pool,
> struct ttm_tt *tt,
> unsigned int order;
>
> page = tt->pages[i];
> - if (unlikely(!page)) {
> + if (unlikely(!page ||
> ttm_backup_page_ptr_is_handle(page))) {
> num_pages = 1;
> continue;
> }
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-07-14 18:33 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-07-02 21:48 [PATCH] drm/ttm: Account for NULL and handle pages in ttm_pool_backup Matthew Brost
2026-07-14 18:33 ` Thomas Hellström
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox