On 7/7/26 8:05 AM, Ruoyu Wang wrote:
> Single-page MOBs and small OTable bases use depth-0 page-table entries
> and do not allocate a page-table BO. Their existing teardown paths were
> written to tolerate that by checking a local BO pointer before reserving
> or fencing it.
>
> Commit 668b206601c5 ("drm/vmwgfx: Stop using raw ttm_buffer_object's")
> changed pt_bo from a raw TTM buffer object pointer to a vmwgfx BO pointer
> and converted those local BO initializers to &pt_bo->tbo. That
> dereferences pt_bo before the existing NULL checks, so depth-0 MOBs can
> crash during OTable teardown or MOB unbind.
>
> Keep the previous conditional behavior by deriving the TTM BO only when
> the MOB has a page-table BO.
>
> This issue was found by a static analysis checker and confirmed by
> manual source review.
>
> Fixes: 668b206601c5 ("drm/vmwgfx: Stop using raw ttm_buffer_object's")
> Signed-off-by: Ruoyu Wang <[email protected]>
> ---
> drivers/gpu/drm/vmwgfx/vmwgfx_mob.c | 9 +++++++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c
> b/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c
> index de7a504de9ce5..7cfd96e6e3489 100644
> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c
> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c
> @@ -204,7 +204,9 @@ static void vmw_takedown_otable_base(struct vmw_private
> *dev_priv,
> if (otable->page_table == NULL)
> return;
>
> - bo = &otable->page_table->pt_bo->tbo;
> + bo = NULL;
You can initialize bo as NULL, like in vmw_mob_unbind().
> + if (otable->page_table->pt_bo)
> + bo = &otable->page_table->pt_bo->tbo;
> cmd = VMW_CMD_RESERVE(dev_priv, sizeof(*cmd));
> if (unlikely(cmd == NULL))
> return;
> @@ -555,7 +557,10 @@ void vmw_mob_unbind(struct vmw_private *dev_priv,
> SVGA3dCmdDestroyGBMob body;
> } *cmd;
> int ret;
> - struct ttm_buffer_object *bo = &mob->pt_bo->tbo;
> + struct ttm_buffer_object *bo = NULL;
> +
> + if (mob->pt_bo)
> + bo = &mob->pt_bo->tbo;
>
> if (bo) {
> ret = ttm_bo_reserve(bo, false, true, NULL);
--
Maaz Mombasawala <[email protected]>
