Re: [PATCH v7 12/17] drm/msm/gem: Set resv before exposing obj

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing NULL check for the return value of `msm_context_vm()` causes a kernel panic when dereferencing the shared resv object.
--

--- Patch [12]: [PATCH v7 12/17] drm/msm/gem: Set resv before exposing obj ---
commit 1309e8291ed5a0d77adef43c83bb315bbd37c9af
Author: Rob Clark <robin.clark@oss.qualcomm.com>

drm/msm/gem: Set resv before exposing obj

Don't swap the resv object _after_ exposing the newly created obj in LRU
or global objects list, as that creates a race condition where another
thread could lock the object using the original (per-obj) resv, but then
unlock after the resv is replaced.

> diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
> index 3c36b1c4a4d59..535c6e1acb3c1 100644
> --- a/drivers/gpu/drm/msm/msm_gem.c
> +++ b/drivers/gpu/drm/msm/msm_gem.c
[ ... ]
> @@ -1136,10 +1136,17 @@ int msm_gem_new_handle(struct drm_device *dev, struct drm_file *file,
>  		size_t size, uint32_t flags, uint32_t *handle,
>  		char *name)
>  {
> -	struct drm_gem_object *obj;
> +	struct drm_gem_object *obj, *r_obj = NULL;
>  	int ret;
>  
> -	obj = msm_gem_new(dev, size, flags);
> +	if (flags & MSM_BO_NO_SHARE) {
> +		struct msm_context *ctx = file->driver_priv;
> +		struct drm_gpuvm *vm = msm_context_vm(dev, ctx);
> +
> +		r_obj = drm_gpuvm_resv_obj(vm);

[Severity: High]
This is a pre-existing issue, but does this code need a NULL check for vm
before dereferencing it to access the shared resv object?

If userspace passes the MSM_BO_NO_SHARE flag in a display-only configuration
where no GPU is attached, msm_context_vm() will return NULL. Passing that
NULL pointer into the drm_gpuvm_resv_obj() macro leads to an immediate kernel
panic. 

Before this patch, the code directly dereferenced ctx->vm which would also be
NULL on display-only setups, so this problem wasn't introduced here but
remains present.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260729155609.20190-1-robin.clark@oss.qualcomm.com?part=12