From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ot1-f98.google.com (mail-ot1-f98.google.com [209.85.210.98]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E87293A9D80 for ; Wed, 8 Jul 2026 01:42:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.98 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783474931; cv=none; b=m3Ad6AJJL7LitJSBmPc+9Q9f7PnFvm3glrP3cT2BPukQgARiYwzckg6v2YR6sPXMhDf51dkz/5G3VpHdq5d09+LsnJmabJ0md/del29knpsDWiNf+cGayPshpXdUBDzkiAMPcNi22BnV1l7WidV2+g+u6HTWKoamwwSZUpYtosU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783474931; c=relaxed/simple; bh=4wm5BDVHy5xD+cnqd1uB2hB7wxKrC1XsZRwGQpHtRGw=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=lTgPHyDEpa+UMi15vYmCrTALP7fkoabdzpSCqi8xqyOYtUKRJ+4hgltJQEmectBQdar6IwWn7J74MivzWqpAblwGMo68FpOnMErKqJr+8mCmBQFruJnpzrxq6Js9iTdcT2lb8ND/pW3FfXXLPueSwa4tVzfJh2UWuQMzRpC9KtM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=broadcom.com; spf=fail smtp.mailfrom=broadcom.com; dkim=pass (1024-bit key) header.d=broadcom.com header.i=@broadcom.com header.b=YPvXOm01; arc=none smtp.client-ip=209.85.210.98 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=broadcom.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=broadcom.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=broadcom.com header.i=@broadcom.com header.b="YPvXOm01" Received: by mail-ot1-f98.google.com with SMTP id 46e09a7af769-7e9fc3de7ceso78672a34.1 for ; Tue, 07 Jul 2026 18:42:09 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783474929; x=1784079729; h=content-transfer-encoding:content-type:in-reply-to:content-language :from:references:cc:to:subject:user-agent:mime-version:date :message-id:dkim-signature:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to:content-type; bh=oWGJMAMsVEI93HlgMZnOI4QQ9qTJSbThhfVSVw6KEYA=; b=DA4gfqaEdbT/MdWqw1JVVrS6nUGTIdTjVJdSvtY0r7DLgX5XRJ/mD3MJMVoZ6fvsP/ LOS9OnhBUDHnuffIJq2iEmXB6LvzbTvSpKDUl3Yn+61p+1mj+PMoYKRJsIW85Px/8piL IsjUtvnJbSsG9RQqxbefR+nFwLJmc3M+oIRRjQMWX+SAwVnMFqja1ceu9h1b9/zwuVTI 7/AI9xsTH6PJqB+akk8wRi71hv9NoJ6I32u56uaEGgCqhQ52xs2p5lkBB/rqDumtDLlp CtK509Z5soRBrh+EyfysQJ106eFxzNG3nq9UbMdbMrqeRAhOn1RecRTTl72kjMzSnAP4 +21A== X-Forwarded-Encrypted: i=1; AFNElJ+oYjTWBPtqGNOQg1pGKJuN6IYEsDOttl0/ZbejNsPjV/OB21T1virajauiPY1KGu5YqE7aeXEWZVCJmTo=@vger.kernel.org X-Gm-Message-State: AOJu0YzUw46AUbWBSOhyqgx7MVuHgzf2sVX7IeBevGM2+uYLiS2+f31V MOcxNrY5yii/QzXj+7Lpz0/5LFkf9lipXVLI3x531pK8CUgn/i1zXr8kPH1xhx+UXz21e6wIa43 l+1kWlOTNzgQiXzqw/T/Bm3KIlnAd4b+lcTnLkx9kEztEAzMC4Z2sVkHBguNSqlX732EVzzy6M2 Qs7a3ipgHwCFdEHwW+bMW3QA/hynV6/7aGO7Bb1ZoAimOI1x9/3djvUwbOO/CEM3hDh9Upw9nWT NJ5s6c7LbEuERsZVpfcki95 X-Gm-Gg: AfdE7ckkI1ThA+wzvCvuWJfe+xPsU5kWE6HqPojZrTMjmaBywSwoo13DuabdTPfhplU 4nYO+9RTwusT1Yo76qCl/3ih3q3Q9lcvz+/v+FGZdRjE8PdEoxw9Gg+tBPAMjEyATePsgnlmiPd dX+XZTxwPMiQ2r7CZSAtcglKWqDTtSflWZ0HNP3zN+0VqPsFQijlgfJsQBCb+66MPW+i0NzSH/u 4BvJLVDgSS9yHlwBsHl54ZSBu/Rh1dm7xwTNgNyt345P4ng/0eGCl5KhisnXT/ehZ5YnRlXJLSM OUm91uWQLD4E0WT01kbVKTf7yNLJU7fEejQ0fpVrkG3Tpy6cVO27ZXDOZK8+HYc3VuI1Aaw6frK 08z7wVUa3urLKxKWuFnsVMsrQ7BhsjduPcVEy/SgvH0GhCIb5qsT5yOs5VazYtlDDDqn5aC7TZ9 B4TqWpianlBEYbIuYa+4Qodr8rKyJX1J8LEiMlC/YeYc2hn7o+AvA= X-Received: by 2002:a05:6830:828d:b0:7e6:7dc7:4542 with SMTP id 46e09a7af769-7ebcff4f700mr280572a34.16.1783474928754; Tue, 07 Jul 2026 18:42:08 -0700 (PDT) Received: from smtp-us-east1-p01-i01-si01.dlp.protect.broadcom.com (address-144-49-247-11.dlp.protect.broadcom.com. [144.49.247.11]) by smtp-relay.gmail.com with ESMTPS id 46e09a7af769-7ebcadfd166sm88138a34.1.2026.07.07.18.42.08 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 07 Jul 2026 18:42:08 -0700 (PDT) X-Relaying-Domain: broadcom.com X-CFilter-Loop: Reflected Received: by mail-qt1-f200.google.com with SMTP id d75a77b69052e-51c0f0a0760so2548341cf.2 for ; Tue, 07 Jul 2026 18:42:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; t=1783474928; x=1784079728; darn=vger.kernel.org; h=content-transfer-encoding:content-type:in-reply-to:content-language :from:references:cc:to:subject:user-agent:mime-version:date :message-id:from:to:cc:subject:date:message-id:reply-to:content-type; bh=oWGJMAMsVEI93HlgMZnOI4QQ9qTJSbThhfVSVw6KEYA=; b=YPvXOm01DZ622MIUwscoR5j0ro0stNuVrqEvIBFQAkjAW5UGHPHoBZ5x7Phu/BnZcB HAHsfdXcjFzO0NFxOqz95VbHebshqLrlf/g7v5g7ciG5lb+09NcjlgDuukFqu6YjyvOb 7tIVRx8RoZpR69wlyk4VpspQlMuinD7rzM3iw= X-Forwarded-Encrypted: i=1; AHgh+Rpr8GidgVwujebobG2zqJ7HwH/nkj5aUGHIzn++SkigLdUxsDAHEDEAeXSYxdAkWp/C3iFNoF9vef3cOpo=@vger.kernel.org X-Received: by 2002:a05:622a:1353:b0:51c:1b22:b84c with SMTP id d75a77b69052e-51c8b4c6ef9mr6876241cf.60.1783474927720; Tue, 07 Jul 2026 18:42:07 -0700 (PDT) X-Received: by 2002:a05:622a:1353:b0:51c:1b22:b84c with SMTP id d75a77b69052e-51c8b4c6ef9mr6875951cf.60.1783474927213; Tue, 07 Jul 2026 18:42:07 -0700 (PDT) Received: from [10.211.247.235] ([192.19.50.250]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-51c4190e9e0sm123925051cf.0.2026.07.07.18.42.05 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 07 Jul 2026 18:42:06 -0700 (PDT) Message-ID: Date: Tue, 7 Jul 2026 18:46:23 -0700 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] drm/vmwgfx: Handle MOBs without page-table BOs To: Ruoyu Wang , zack.rusin@broadcom.com, bcm-kernel-feedback-list@broadcom.com, maarten.lankhorst@linux.intel.com, mripard@kernel.org, tzimmermann@suse.de, airlied@gmail.com, simona@ffwll.ch Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org References: <20260707150544.2272933-1-ruoyuw560@gmail.com> From: Maaz Mombasawala Content-Language: en-US In-Reply-To: <20260707150544.2272933-1-ruoyuw560@gmail.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-DetectorID-Processed: b00c1d49-9d2e-4205-b15f-d015386d3d5e On 7/7/26 8:05 AM, Ruoyu Wang wrote: > Single-page MOBs and small OTable bases use depth-0 page-table entries > and do not allocate a page-table BO. Their existing teardown paths were > written to tolerate that by checking a local BO pointer before reserving > or fencing it. > > Commit 668b206601c5 ("drm/vmwgfx: Stop using raw ttm_buffer_object's") > changed pt_bo from a raw TTM buffer object pointer to a vmwgfx BO pointer > and converted those local BO initializers to &pt_bo->tbo. That > dereferences pt_bo before the existing NULL checks, so depth-0 MOBs can > crash during OTable teardown or MOB unbind. > > Keep the previous conditional behavior by deriving the TTM BO only when > the MOB has a page-table BO. > > This issue was found by a static analysis checker and confirmed by > manual source review. > > Fixes: 668b206601c5 ("drm/vmwgfx: Stop using raw ttm_buffer_object's") > Signed-off-by: Ruoyu Wang > --- > drivers/gpu/drm/vmwgfx/vmwgfx_mob.c | 9 +++++++-- > 1 file changed, 7 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c b/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c > index de7a504de9ce5..7cfd96e6e3489 100644 > --- a/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c > +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c > @@ -204,7 +204,9 @@ static void vmw_takedown_otable_base(struct vmw_private *dev_priv, > if (otable->page_table == NULL) > return; > > - bo = &otable->page_table->pt_bo->tbo; > + bo = NULL; You can initialize bo as NULL, like in vmw_mob_unbind(). > + if (otable->page_table->pt_bo) > + bo = &otable->page_table->pt_bo->tbo; > cmd = VMW_CMD_RESERVE(dev_priv, sizeof(*cmd)); > if (unlikely(cmd == NULL)) > return; > @@ -555,7 +557,10 @@ void vmw_mob_unbind(struct vmw_private *dev_priv, > SVGA3dCmdDestroyGBMob body; > } *cmd; > int ret; > - struct ttm_buffer_object *bo = &mob->pt_bo->tbo; > + struct ttm_buffer_object *bo = NULL; > + > + if (mob->pt_bo) > + bo = &mob->pt_bo->tbo; > > if (bo) { > ret = ttm_bo_reserve(bo, false, true, NULL); -- Maaz Mombasawala