Re: [PATCH v2 2/3] drm/msm: Validate lazy VM is created in GEM_SUBMIT

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] The MSM_PARAM_EN_VM_BIND ioctl validation compares an uninitialized context VM against the global VM, failing to prevent VM_BIND enablement on GPUs without per-process page tables.
--

commit 0fcb5ea6b90013aec15c2f186ee0bbf02e4e4818
Author: Rob Clark <robin.clark@oss.qualcomm.com>

drm/msm: Validate lazy VM is created in GEM_SUBMIT
    
Otherwise a GEM_SUBMIT ioctl before any BOs are mapped could cause a
NPE.

> diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
> index 3c6bc90c3d486..56929e8212008 100644
> --- a/drivers/gpu/drm/msm/msm_gem_submit.c
> +++ b/drivers/gpu/drm/msm/msm_gem_submit.c
[ ... ]
> @@ -572,7 +573,7 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
>  	if (args->pad)
>  		return -EINVAL;
>  
> -	if (to_msm_vm(ctx->vm)->unusable)
> +	if (vm && to_msm_vm(vm)->unusable)
>  		return UERR(EPIPE, dev, "context is unusable");

[Severity: Critical]
This is a pre-existing issue, but since we are fixing lazy VM access
here, is there a similar issue in adreno_set_param() when handling
MSM_PARAM_EN_VM_BIND?

Looking at drivers/gpu/drm/msm/adreno/adreno_gpu.c:

adreno_set_param()
{
    ...
	case MSM_PARAM_EN_VM_BIND:
		/* We can only support VM_BIND with per-process pgtables: */
		if (ctx->vm == gpu->vm)
			return UERR(EINVAL, drm, "requires per-process pgtables");

Because ctx->vm can be NULL prior to lazy initialization, this check
evaluates to false, allowing the restriction to be bypassed.

Could this allow an unprivileged user to enable userspace management
(VM_BIND) on older GPUs that fall back to the globally shared GPU VM,
and overwrite page tables shared by other processes?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260625191537.47965-1-robin.clark@oss.qualcomm.com?part=2