[PATCH 03/15] drm/xe/vm: Clear the scratch_pt pointer on error

[Matthew Brost]

On Wed, Aug 13, 2025 at 12:51:09PM +0200, Thomas Hellström wrote:
> Avoid triggering a dereference of an error pointer on cleanup in
> xe_vm_free_scratch() by clearing any scratch_pt error pointer.
> 
> Signed-off-by: Thomas Hellström <thomas.hellstrom at linux.intel.com>
> Fixes: 06951c2ee72d ("drm/xe: Use NULL PTEs as scratch PTEs")
> Cc: Brian Welty <brian.welty at intel.com>
> Cc: Rodrigo Vivi <rodrigo.vivi at intel.com>
> Cc: Lucas De Marchi <lucas.demarchi at intel.com>
> Cc: <stable at vger.kernel.org> # v6.8+

Reviewed-by: Matthew Brost <matthew.brost at intel.com>

> ---
>  drivers/gpu/drm/xe/xe_vm.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c
> index d40d2d43c041..12e661960244 100644
> --- a/drivers/gpu/drm/xe/xe_vm.c
> +++ b/drivers/gpu/drm/xe/xe_vm.c
> @@ -1635,8 +1635,12 @@ static int xe_vm_create_scratch(struct xe_device *xe, struct xe_tile *tile,
>  
>  	for (i = MAX_HUGEPTE_LEVEL; i < vm->pt_root[id]->level; i++) {
>  		vm->scratch_pt[id][i] = xe_pt_create(vm, tile, i);
> -		if (IS_ERR(vm->scratch_pt[id][i]))
> -			return PTR_ERR(vm->scratch_pt[id][i]);
> +		if (IS_ERR(vm->scratch_pt[id][i])) {
> +			int err = PTR_ERR(vm->scratch_pt[id][i]);
> +
> +			vm->scratch_pt[id][i] = NULL;
> +			return err;
> +		}
>  
>  		xe_pt_populate_empty(tile, vm, vm->scratch_pt[id][i]);
>  	}
> -- 
> 2.50.1
>