drm/xe/vm: Clear the scratch_pt pointer on error

commit 2b55ddf36229e0278c956215784ab1feeff510aa upstream.

Avoid triggering a dereference of an error pointer on cleanup in
xe_vm_free_scratch() by clearing any scratch_pt error pointer.

Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Fixes: 06951c2ee72d ("drm/xe: Use NULL PTEs as scratch PTEs")
Cc: Brian Welty <brian.welty@intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: Lucas De Marchi <lucas.demarchi@intel.com>
Cc: <stable@vger.kernel.org> # v6.8+
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://lore.kernel.org/r/20250821143045.106005-4-thomas.hellstrom@linux.intel.com
(cherry picked from commit 358ee50ab565f3c8ea32480e9d03127a81ba32f8)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c
index 15fd497c920c8ec923459dbf4725b6f7eaba31ba..a4845d4213b0061a3ea61ee45f3a58a10d79591d 100644 (file)
--- a/drivers/gpu/drm/xe/xe_vm.c
+++ b/drivers/gpu/drm/xe/xe_vm.c
@@ -1402,8 +1402,12 @@ static int xe_vm_create_scratch(struct xe_device *xe, struct xe_tile *tile,
 
        for (i = MAX_HUGEPTE_LEVEL; i < vm->pt_root[id]->level; i++) {
                vm->scratch_pt[id][i] = xe_pt_create(vm, tile, i);
-               if (IS_ERR(vm->scratch_pt[id][i]))
-                       return PTR_ERR(vm->scratch_pt[id][i]);
+               if (IS_ERR(vm->scratch_pt[id][i])) {
+                       int err = PTR_ERR(vm->scratch_pt[id][i]);
+
+                       vm->scratch_pt[id][i] = NULL;
+                       return err;
+               }
 
                xe_pt_populate_empty(tile, vm, vm->scratch_pt[id][i]);
        }