Re: [PATCH v5 2/5] drm/gpusvm: embed struct drm_device into drm_gpusvm_pages

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Leak of device page DMA mappings in `drm_gpusvm_get_pages()` error path due to deferred assignment of `dpagemap`.
--

commit dfe7715229bc403af2e0a2fb749a3ef0875d2fdf
Author: Honglei Huang <honghuan@amd.com>
Subject: drm/gpusvm: embed struct drm_device into drm_gpusvm_pages

This patch embeds a drm_device pointer directly into drm_gpusvm_pages to
make the physical pages and their DMA view inherently bound to a specific
drm_device. It updates the DMA mapping functions to route all DMA through
svm_pages->drm instead of gpusvm->drm.

> diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c
> index df900553f21a4..155e3c2e703d9 100644
> --- a/drivers/gpu/drm/drm_gpusvm.c
> +++ b/drivers/gpu/drm/drm_gpusvm.c
[ ... ]
> @@ -1532,10 +1541,10 @@ int drm_gpusvm_get_pages(struct drm_gpusvm *gpusvm,
>  			}
>  			svm_pages->dma_addr[j] =
>  				dpagemap->ops->device_map(dpagemap,
> -							  gpusvm->drm->dev,
> +							  svm_pages->drm->dev,
>  							  page, order,
>  							  dma_dir);
> -			if (dma_mapping_error(gpusvm->drm->dev,
> +			if (dma_mapping_error(svm_pages->drm->dev,
>  					      svm_pages->dma_addr[j].addr)) {
>  				err = -EFAULT;
>  				goto err_unmap;

[Severity: High]
This is a pre-existing issue, but does this error path permanently leak
device page DMA mappings?

If dma_mapping_error() fails here (or if dma_iova_sync() fails later), the
code jumps to the err_unmap label which calls __drm_gpusvm_unmap_pages():

err_unmap:
	svm_pages->flags.has_dma_mapping = true;
	__drm_gpusvm_unmap_pages(gpusvm, svm_pages, num_dma_mapped);

However, svm_pages->dpagemap isn't assigned until the end of
drm_gpusvm_get_pages() on complete success.

In __drm_gpusvm_unmap_pages(), it checks:

	struct drm_pagemap *dpagemap = svm_pages->dpagemap;
	...
	else if (dpagemap && dpagemap->ops->device_unmap)

Since svm_pages->dpagemap is still NULL during the error path, the device
unmap operations will be skipped, leaving the successfully mapped device pages
in this batch leaked.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260627035418.3796481-1-honglei1.huang@amd.com?part=2