You need to add Natalie and Arun as well, they are the new TTM maintainers.
On 10/9/26 03:18, Jesse Zhang wrote:
> ttm_tt objects for imported sg tables (ttm_bo_type_sg, set up by
> ttm_sg_tt_init() with TTM_TT_FLAG_EXTERNAL) only have DMA addresses and
> no pages array. ttm_bo_kmap() and ttm_bo_vmap() still dereference
> ttm->pages for them, so a driver that tries to CPU map such a BO oopses
> instead of getting an error:
>
> BUG: kernel NULL pointer dereference, address: 0000000000000000
> RIP: 0010:ttm_bo_kmap+0x26c/0x300 [ttm]
> Call Trace:
> amdgpu_bo_kmap+0x89/0xb0 [amdgpu]
> amdgpu_userq_fence_read_wptr+0x116/0x170 [amdgpu]
> amdgpu_userq_signal_ioctl+0x3fe/0xbb0 [amdgpu]
>
> Return -EINVAL in that case, like ttm_bo_kmap_try_from_panic() already
> checks for a missing pages array.
>
> Fixes: 75a57669cbc8 ("drm/ttm: add ttm_sg_tt_init")
> Suggested-by: Christian König <[email protected]>
> Signed-off-by: Jesse Zhang <[email protected]>
CC: stable?
Reviewed-by: Christian König <[email protected]>
Regards,
Christian.
> ---
> drivers/gpu/drm/ttm/ttm_bo_util.c | 11 +++++++++--
> 1 file changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c
> b/drivers/gpu/drm/ttm/ttm_bo_util.c
> index 3e3c201a0222..83142bfa3bc1 100644
> --- a/drivers/gpu/drm/ttm/ttm_bo_util.c
> +++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
> @@ -356,6 +356,10 @@ static int ttm_bo_kmap_ttm(struct ttm_buffer_object *bo,
> if (ret)
> return ret;
>
> + /* Imported sg tables only come with DMA addresses, no pages to map. */
> + if (!ttm->pages)
> + return -EINVAL;
> +
> if (num_pages == 1 && ttm->caching == ttm_cached &&
> !(man->use_tt && (ttm->page_flags & TTM_TT_FLAG_DECRYPTED))) {
> /*
> @@ -419,7 +423,7 @@ EXPORT_SYMBOL(ttm_bo_kmap_try_from_panic);
> *
> * Returns
> * -ENOMEM: Out of memory.
> - * -EINVAL: Invalid range.
> + * -EINVAL: Invalid range or the BO has no pages to map.
> */
> int ttm_bo_kmap(struct ttm_buffer_object *bo,
> unsigned long start_page, unsigned long num_pages,
> @@ -493,7 +497,7 @@ EXPORT_SYMBOL(ttm_bo_kunmap);
> *
> * Returns
> * -ENOMEM: Out of memory.
> - * -EINVAL: Invalid range.
> + * -EINVAL: Invalid range or the BO has no pages to map.
> */
> int ttm_bo_vmap(struct ttm_buffer_object *bo, struct iosys_map *map)
> {
> @@ -537,6 +541,9 @@ int ttm_bo_vmap(struct ttm_buffer_object *bo, struct
> iosys_map *map)
> if (ret)
> return ret;
>
> + if (!ttm->pages)
> + return -EINVAL;
> +
> /*
> * We need to use vmap to get the desired page protection
> * or to make the buffer object look contiguous.
