Re: [PATCH v3 4/6] drm/pagemap: dma-unmap pages before handling migration errors

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Valid DMA address 0 is leaked because `drm_pagemap_migrate_unmap_pages` skips unmapping when `pagemap_addr[i].addr == 0`, leading to a stale IOMMU mapping and potential use-after-free.
--

--- Patch [4]: [PATCH v3 4/6] drm/pagemap: dma-unmap pages before handling migration errors ---
commit 449a54e82e1a7fd00fc19c70ae34414088711db1
Author: Matthew Brost <matthew.brost@intel.com>

    drm/pagemap: dma-unmap pages before handling migration errors

This commit reorders the cleanup sequence during migration errors. It ensures
that DMA unmapping occurs before the pages array is cleared, preventing missing
unmaps due to invalid page information.

> diff --git a/drivers/gpu/drm/drm_pagemap.c b/drivers/gpu/drm/drm_pagemap.c
> index 892b325fa99b8..aef1fcea663d5 100644
> --- a/drivers/gpu/drm/drm_pagemap.c
> +++ b/drivers/gpu/drm/drm_pagemap.c
> @@ -1175,12 +1175,12 @@ int drm_pagemap_evict_to_ram(struct drm_pagemap_devmem *devmem_allocation)
>  		goto err_finalize;
>  
>  err_finalize:
> +	drm_pagemap_migrate_unmap_pages(devmem_allocation->dev, pagemap_addr, dst, npages,
> +					DMA_FROM_DEVICE, &state);

[Severity: Critical]
This is a pre-existing issue, but does the check inside
drm_pagemap_migrate_unmap_pages() accidentally leak valid DMA address 0?

drivers/gpu/drm/drm_pagemap.c:drm_pagemap_migrate_unmap_pages() {
    ...
	if (!page || !pagemap_addr[i].addr || dma_mapping_error(dev, pagemap_addr[i].addr))
		goto next;
    ...
}

Since 0 is a valid DMA address on many platforms, skipping the unmap when
pagemap_addr[i].addr == 0 might leave a stale IOMMU mapping. 

When the page is subsequently freed, could a malicious userspace instruct the
GPU to access this DMA address and cause memory corruption or an IOMMU
use-after-free?

>  	if (err)
>  		drm_pagemap_migration_unlock_put_pages(npages, dst);
>  	migrate_device_pages(src, dst, npages);
>  	migrate_device_finalize(src, dst, npages);
> -	drm_pagemap_migrate_unmap_pages(devmem_allocation->dev, pagemap_addr, dst, npages,
> -					DMA_FROM_DEVICE, &state);
>  
>  err_free:
>  	kvfree(buf);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260805231041.3791771-1-matthew.brost@intel.com?part=4