Re: [PATCH v2 3/3] drm/msm: Validate lazy VM in GEM_NEW

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The newly allocated GEM object 'obj' is leaked on the error path if the VM is not found or unsupported.
--

commit ebb450a0150beb70fa2ad61c737f157a48b8cb86
Author: Rob Clark <robin.clark@oss.qualcomm.com>

drm/msm: Validate lazy VM in GEM_NEW

Otherwise creating a _NO_SHARE BO before any BOs are mapped could cause
a NPE.

> diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
> index efd3d3c9a4490..733a094354e1d 100644
> --- a/drivers/gpu/drm/msm/msm_gem.c
> +++ b/drivers/gpu/drm/msm/msm_gem.c
> @@ -1147,7 +1147,12 @@ int msm_gem_new_handle(struct drm_device *dev, struct drm_file *file,
>  
>  	if (flags & MSM_BO_NO_SHARE) {
>  		struct msm_context *ctx = file->driver_priv;
> -		struct drm_gem_object *r_obj = drm_gpuvm_resv_obj(ctx->vm);
> +		struct drm_gpuvm *vm = msm_context_vm(dev, ctx);
> +
> +		if (!vm)
> +			return UERR(EINVAL, dev, "not supported with shared VM");
                        ^^^^

[Severity: High]
Does this code leak the newly allocated obj?

Looking earlier in msm_gem_new_handle(), obj is allocated:

	obj = msm_gem_new(dev, size, flags);

	if (IS_ERR(obj))
		return PTR_ERR(obj);

If vm is NULL, we return directly here without calling drm_gem_object_put(obj)
to release the reference.

> +
> +		struct drm_gem_object *r_obj = drm_gpuvm_resv_obj(vm);
>  
>  		drm_gem_object_get(r_obj);
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260625191537.47965-1-robin.clark@oss.qualcomm.com?part=3