Re: Patch "drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init()" has been added to the 7.2-stable tree

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unfixed teardown kernel panic when gpu_buddy_init() fails
--

commit 96e42e3ef488e9ad28452efe2bd6b23f7a53c47b
Author: Thomas Hellström <thomas.hellstrom@linux.intel.com>

drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init()

The commit moves drmm_cgroup_register_region() to after the list and
buddy allocator are fully initialized to fix a teardown kernel panic.
When drmm_cgroup_register_region() fails, it triggers the teardown path
which used to crash because the buddy allocator and lists weren't
initialized.

Link: https://patch.msgid.link/20260725100036.2372-2-thomas.hellstrom@linux.intel.com

> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
> index 2a241a5b12c42..ac3f71d77140a 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c

[ ... ]

> @@ -935,6 +932,10 @@ int amdgpu_vram_mgr_init(struct amdgpu_device *adev)
>  	if (err)
>  		return err;

[Severity: High]
This is a pre-existing issue, but does this still lead to a kernel panic
during teardown if gpu_buddy_init() fails?

Because adev->mman.initialized is set to true earlier in amdgpu_ttm_init(),
a failure from gpu_buddy_init() triggers the teardown path in
amdgpu_ttm_fini(), which calls amdgpu_vram_mgr_fini().

amdgpu_vram_mgr_fini() unconditionally calls gpu_buddy_fini():

drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c:amdgpu_vram_mgr_fini() {
    ...
	if (!adev->gmc.is_app_apu)
		gpu_buddy_fini(&mgr->mm);
    ...
}

However, if gpu_buddy_init() fails, it cleans up internally and leaves
mm->free_trees as a NULL or dangling pointer:

drivers/gpu/buddy.c:gpu_buddy_init() {
    ...
out_free_tree:
	while (i--)
		kfree(mm->free_trees[i]);
	kfree(mm->free_trees);
	return -ENOMEM;
}

Then gpu_buddy_fini() blindly iterates over these pointers:

drivers/gpu/buddy.c:gpu_buddy_fini() {
    ...
	for_each_free_tree(i)
		kfree(mm->free_trees[i]);

	kfree(mm->free_trees);
	kfree(mm->roots);
}

Could this crash during module load under memory pressure when the
allocation in gpu_buddy_init() fails?

>  
> +	man->cg = drmm_cgroup_register_region(adev_to_drm(adev), "vram", adev->gmc.real_vram_size);
> +	if (IS_ERR(man->cg))
> +		return PTR_ERR(man->cg);
> +
>  	ttm_set_driver_manager(&adev->mman.bdev, TTM_PL_VRAM, &mgr->manager);
>  	ttm_resource_manager_set_used(man, true);
>  	return 0;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/2026090939-sarcasm-demeaning-4889@gregkh?part=1