Re: [PATCH V19 07/15] drm/xe/vram: Extract buddy alloc and free helpers

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Uninitialized output parameter `used_visible` in `xe_ttm_vram_buddy_alloc()`.
--

commit 9483caeb9aea9c04580bdd071e565c0158f680fa
Author: Tejas Upadhyay <tejas.upadhyay@intel.com>

drm/xe/vram: Extract buddy alloc and free helpers

This commit factors out block allocation and freeing into reusable helpers
xe_ttm_vram_buddy_alloc() and xe_ttm_vram_buddy_free(). These helpers
consolidate block allocation with visible-size tracking for upcoming VRAM
page offline reservation paths.

> diff --git a/drivers/gpu/drm/xe/xe_ttm_vram_mgr.c b/drivers/gpu/drm/xe/xe_ttm_vram_mgr.c
> index 51e983ee3bad4..16ecea4977809 100644
> --- a/drivers/gpu/drm/xe/xe_ttm_vram_mgr.c
> +++ b/drivers/gpu/drm/xe/xe_ttm_vram_mgr.c
[ ... ]
> +static int xe_ttm_vram_buddy_alloc(struct xe_ttm_vram_mgr *mgr, u64 start,
> +				   u64 end, u64 size, u64 min_page_size,
> +				   struct list_head *blocks, unsigned long flags,
> +				   void *priv, u64 *used_visible)
> +{
[ ... ]
> +	if (end <= mgr->visible_size) {
> +		*used_visible = size;
> +	} else {
> +		list_for_each_entry(block, blocks, link) {
> +			u64 blk_start = gpu_buddy_block_offset(block);
> +
> +			if (blk_start < mgr->visible_size) {
> +				u64 blk_end = blk_start + gpu_buddy_block_size(mm, block);
> +
> +				*used_visible += min(blk_end, mgr->visible_size) - blk_start;

[Severity: Medium]
Does this accumulate into an uninitialized variable?

In this else branch, *used_visible is incremented via += without being
explicitly zeroed first. If a caller does not explicitly initialize the
memory pointed to by used_visible before calling xe_ttm_vram_buddy_alloc(),
this will accumulate garbage values and corrupt the VRAM visible memory
accounting in mgr->visible_avail.

While current callers seem to pass pointers to zero-allocated memory,
could *used_visible be explicitly initialized to 0 before the loop to
prevent a trap for future callers?

> +			}
> +		}
> +	}
> +
> +	mgr->visible_avail -= *used_visible;
> +	return 0;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831064942.315720-17-tejas.upadhyay@intel.com?part=7