On 10/9/2026 4:03 PM, Jesse Zhang wrote:
ttm_tt objects for imported sg tables (ttm_bo_type_sg, set up by
ttm_sg_tt_init() with TTM_TT_FLAG_EXTERNAL) only have DMA addresses and
no pages array. ttm_bo_kmap() and ttm_bo_vmap() still dereference
ttm->pages for them, so a driver that tries to CPU map such a BO oopses
instead of getting an error:
BUG: kernel NULL pointer dereference, address: 0000000000000000
RIP: 0010:ttm_bo_kmap+0x26c/0x300 [ttm]
Call Trace:
amdgpu_bo_kmap+0x89/0xb0 [amdgpu]
amdgpu_userq_fence_read_wptr+0x116/0x170 [amdgpu]
amdgpu_userq_signal_ioctl+0x3fe/0xbb0 [amdgpu]
Return -EINVAL in that case, like ttm_bo_kmap_try_from_panic() already
checks for a missing pages array.
Fixes: 75a57669cbc8 ("drm/ttm: add ttm_sg_tt_init")
Cc: [email protected]
Suggested-by: Christian König <[email protected]>
Reviewed-by: Christian König <[email protected]>
Signed-off-by: Jesse Zhang <[email protected]>
I have upstreamed this patch.
Regards,
Arun.
---
drivers/gpu/drm/ttm/ttm_bo_util.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c
b/drivers/gpu/drm/ttm/ttm_bo_util.c
index 3e3c201a0222..83142bfa3bc1 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -356,6 +356,10 @@ static int ttm_bo_kmap_ttm(struct ttm_buffer_object *bo,
if (ret)
return ret;
+ /* Imported sg tables only come with DMA addresses, no pages to map. */
+ if (!ttm->pages)
+ return -EINVAL;
+
if (num_pages == 1 && ttm->caching == ttm_cached &&
!(man->use_tt && (ttm->page_flags & TTM_TT_FLAG_DECRYPTED))) {
/*
@@ -419,7 +423,7 @@ EXPORT_SYMBOL(ttm_bo_kmap_try_from_panic);
*
* Returns
* -ENOMEM: Out of memory.
- * -EINVAL: Invalid range.
+ * -EINVAL: Invalid range or the BO has no pages to map.
*/
int ttm_bo_kmap(struct ttm_buffer_object *bo,
unsigned long start_page, unsigned long num_pages,
@@ -493,7 +497,7 @@ EXPORT_SYMBOL(ttm_bo_kunmap);
*
* Returns
* -ENOMEM: Out of memory.
- * -EINVAL: Invalid range.
+ * -EINVAL: Invalid range or the BO has no pages to map.
*/
int ttm_bo_vmap(struct ttm_buffer_object *bo, struct iosys_map *map)
{
@@ -537,6 +541,9 @@ int ttm_bo_vmap(struct ttm_buffer_object *bo, struct
iosys_map *map)
if (ret)
return ret;
+ if (!ttm->pages)
+ return -EINVAL;
+
/*
* We need to use vmap to get the desired page protection
* or to make the buffer object look contiguous.
