Re: [PATCH v5 06/10] drm/msm: Allow lazy VM creation to fail

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Direct access to `ctx->vm` via `drm_gpuvm_resv_obj()` in `msm_gem_new_handle()` causes a NULL pointer dereference when called before the VM is lazily initialized.
--

--- Patch [6]: [PATCH v5 06/10] drm/msm: Allow lazy VM creation to fail ---
commit b8fda3fb0d624d38526d9746f2057050a7931a85
Author: Rob Clark <robin.clark@oss.qualcomm.com>

drm/msm: Allow lazy VM creation to fail

In the next commit, we'll stop falling back to shared VM if private VM
creation fails. This isn't expected to happen in practice, it would either
require small memory allocations to fail, or missing support in arm-smmu-qcom.

> diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
> index 26ea8a28be474..06b142d82e4d0 100644
> --- a/drivers/gpu/drm/msm/msm_gem_submit.c
> +++ b/drivers/gpu/drm/msm/msm_gem_submit.c
[ ... ]
> @@ -554,6 +554,7 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
>  	struct msm_drm_private *priv = dev->dev_private;
>  	struct drm_msm_gem_submit *args = data;
>  	struct msm_context *ctx = file->driver_priv;
> +	struct drm_gpuvm *vm = msm_context_vm(dev, ctx);

[Severity: High]
This is a pre-existing issue, but seeing msm_context_vm() added here made
me look at other places where ctx->vm is accessed, and I noticed a potential
issue in msm_gem_new_handle().

If a user opens the DRM device and directly issues the DRM_IOCTL_MSM_GEM_NEW
ioctl with the MSM_BO_NO_SHARE flag before the VM is lazily initialized
(e.g., before creating a submitqueue), could this result in a NULL pointer
dereference?

> drivers/gpu/drm/msm/msm_gem.c:msm_gem_new_handle() {
> 	...
> 	if (flags & MSM_BO_NO_SHARE) {
> 		struct msm_context *ctx = file->driver_priv;
> 		struct drm_gem_object *r_obj = drm_gpuvm_resv_obj(ctx->vm);

Because drm_gpuvm_resv_obj(ctx->vm) directly dereferences the pointer
without calling msm_context_vm() first to ensure it is created, it seems
this could crash the kernel if ctx->vm is still NULL.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260716201538.365824-1-robin.clark@oss.qualcomm.com?part=6