]> git.ipfire.org Git - thirdparty/kernel/linux.git/commitdiff
drm/xe: Do not dereference ggtt_node in xe_bo.c
authorMaarten Lankhorst <dev@lankhorst.se>
Thu, 8 Jan 2026 10:10:20 +0000 (11:10 +0100)
committerMaarten Lankhorst <dev@lankhorst.se>
Mon, 12 Jan 2026 15:28:47 +0000 (16:28 +0100)
A careful inspection of __xe_ggtt_insert_bo_at() shows that
the ggtt_node can always be seen as inserted from xe_bo.c
due to the way error handling is performed.

The checks are also a little bit too paranoid, since we
never create a bo with ggtt_node[id] initialised but not
inserted into the GGTT, which can be seen by looking at
__xe_ggtt_insert_bo_at()

Additionally, the size of the GGTT is never bigger than 4 GB,
so adding a check at that level is incorrect.

Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://patch.msgid.link/20260108101014.579906-14-dev@lankhorst.se
drivers/gpu/drm/xe/xe_bo.c

index 408c74216fdf251b12e387cde31a2db73a62a419..917e50c276ac98921e15f816ffaff6f5602ac919 100644 (file)
@@ -1715,7 +1715,7 @@ static void xe_ttm_bo_destroy(struct ttm_buffer_object *ttm_bo)
        xe_assert(xe, list_empty(&ttm_bo->base.gpuva.list));
 
        for_each_tile(tile, xe, id)
-               if (bo->ggtt_node[id] && bo->ggtt_node[id]->base.size)
+               if (bo->ggtt_node[id])
                        xe_ggtt_remove_bo(tile->mem.ggtt, bo);
 
 #ifdef CONFIG_PROC_FS
@@ -3609,8 +3609,8 @@ void xe_bo_put(struct xe_bo *bo)
                        might_lock(&bo->client->bos_lock);
 #endif
                for_each_tile(tile, xe_bo_device(bo), id)
-                       if (bo->ggtt_node[id] && bo->ggtt_node[id]->ggtt)
-                               xe_ggtt_might_lock(bo->ggtt_node[id]->ggtt);
+                       if (bo->ggtt_node[id])
+                               xe_ggtt_might_lock(tile->mem.ggtt);
                drm_gem_object_put(&bo->ttm.base);
        }
 }