drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test.

[ Upstream commit 1cda3c755bb7770be07d75949bb0f45fb88651f6 ]

I saw an oops in xe_gem_fault when running the xe-fast-feedback
testlist against the realtime kernel without debug options enabled.

The panic happens after core_hotunplug unbind-rebind finishes.
Presumably what happens is that a process mmaps, unlocks because
of the FAULT_FLAG_RETRY_NOWAIT logic, has no process memory left,
causing ttm_bo_vm_dummy_page() to return VM_FAULT_NOPAGE, since
there was nothing left to populate, and then oopses in
"mem_type_is_vram(tbo->resource->mem_type)" because tbo->resource
is NULL.

It's convoluted, but fits the data and explains the oops after
the test exits.

Reviewed-by: Matthew Auld <matthew.auld@intel.com>
Link: https://lore.kernel.org/r/20250715152057.23254-2-dev@lankhorst.se
Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c
index 50c79049ccea0ec8c1fc3a64d31ebd2cd40f6ec3..d07e23eb1a54dee596304b504f69278db70cf8fe 100644 (file)
--- a/drivers/gpu/drm/xe/xe_bo.c
+++ b/drivers/gpu/drm/xe/xe_bo.c
@@ -1711,22 +1711,26 @@ static vm_fault_t xe_gem_fault(struct vm_fault *vmf)
                ret = ttm_bo_vm_fault_reserved(vmf, vmf->vma->vm_page_prot,
                                               TTM_BO_VM_NUM_PREFAULT);
                drm_dev_exit(idx);
+
+               if (ret == VM_FAULT_RETRY &&
+                   !(vmf->flags & FAULT_FLAG_RETRY_NOWAIT))
+                       goto out;
+
+               /*
+                * ttm_bo_vm_reserve() already has dma_resv_lock.
+                */
+               if (ret == VM_FAULT_NOPAGE &&
+                   mem_type_is_vram(tbo->resource->mem_type)) {
+                       mutex_lock(&xe->mem_access.vram_userfault.lock);
+                       if (list_empty(&bo->vram_userfault_link))
+                               list_add(&bo->vram_userfault_link,
+                                        &xe->mem_access.vram_userfault.list);
+                       mutex_unlock(&xe->mem_access.vram_userfault.lock);
+               }
        } else {
                ret = ttm_bo_vm_dummy_page(vmf, vmf->vma->vm_page_prot);
        }
 
-       if (ret == VM_FAULT_RETRY && !(vmf->flags & FAULT_FLAG_RETRY_NOWAIT))
-               goto out;
-       /*
-        * ttm_bo_vm_reserve() already has dma_resv_lock.
-        */
-       if (ret == VM_FAULT_NOPAGE && mem_type_is_vram(tbo->resource->mem_type)) {
-               mutex_lock(&xe->mem_access.vram_userfault.lock);
-               if (list_empty(&bo->vram_userfault_link))
-                       list_add(&bo->vram_userfault_link, &xe->mem_access.vram_userfault.list);
-               mutex_unlock(&xe->mem_access.vram_userfault.lock);
-       }
-
        dma_resv_unlock(tbo->base.resv);
 out:
        if (needs_rpm)