Re: [PATCH v8 4/5] drm/gpusvm: move struct drm_gpusvm_pages out of struct drm_gpusvm_range

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Device memory mappings created via `dpagemap->ops->device_map()` are permanently leaked on the error path of `drm_gpusvm_get_pages()`.
--

commit 5200250940d89eac5e1be4b8695f694419586335
Author: Honglei Huang <honghuan@amd.com>

drm/gpusvm: move struct drm_gpusvm_pages out of struct drm_gpusvm_range

This patch separates physical pages from the MM VA range in the DRM GPU SVM
framework. It moves the drm_gpusvm_pages object out of drm_gpusvm_range,
allowing drivers to directly manage MM and device physical pages. The range
level wrappers are replaced with helpers that operate directly on a driver
owned pages object.

> diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c
> index b0e9a2db10803..e0fd0b2fcc5ee 100644
> --- a/drivers/gpu/drm/drm_gpusvm.c
> +++ b/drivers/gpu/drm/drm_gpusvm.c

[ ... ]

> @@ -1638,29 +1695,6 @@ int drm_gpusvm_get_pages(struct drm_gpusvm *gpusvm,
>  }
>  EXPORT_SYMBOL_GPL(drm_gpusvm_get_pages);

[Severity: High]
This is a pre-existing issue, but does this error path permanently leak
device memory mappings?

If drm_gpusvm_get_pages() maps the first part of a memory range using
device_map(), but then hits a page with a different pagemap (or crosses a
zone device data boundary):

drivers/gpu/drm/drm_gpusvm.c:drm_gpusvm_get_pages() {
    ...
    if (pagemap != page_pgmap(page)) {
        if (pagemap) {
            err = -EOPNOTSUPP;
            goto err_unmap;
        }
    ...
}

It jumps to err_unmap before svm_pages->dpagemap is set.

When it calls __drm_gpusvm_unmap_pages() to clean up:

drivers/gpu/drm/drm_gpusvm.c:__drm_gpusvm_unmap_pages() {
    ...
    else if (dpagemap && dpagemap->ops->device_unmap)
        dpagemap->ops->device_unmap(dpagemap, dev, addr);
    ...
}

Because dpagemap evaluates to NULL on this error path, device_unmap() is
skipped, which appears to leak the previously mapped resources.

Could a local user repeatedly trigger this error path to exhaust device or
IOMMU resources?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260630033132.361144-1-honghuan@amd.com?part=4