Re: [PATCH 1/3] drm/ttm: check for NULL resource in ttm_bo_kmap()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] drm/ttm: inaccurate Fixes trailer in ttm_bo_kmap() NULL check
  commit
--

commit 96feeda5517d178ff64fe467f6cc8933b44eb0d5
Author: Harsh Parmar <kaii02ctf@gmail.com>

> drm/ttm: check for NULL resource in ttm_bo_kmap()
>
> A buffer object can legitimately have no backing store: a driver may
> call ttm_bo_init_reserved() with zero placements, which leaves
> bo->resource NULL. It can also become NULL after the backing store has
> been released.
>
> ttm_bo_kmap() dereferences bo->resource unconditionally (res->size),
> causing a NULL pointer dereference and kernel oops when called on such a
> buffer.
>
> Bail out with -EINVAL if the buffer has no backing store.
>
> Fixes: d3116756a710 ("drm/ttm: rename bo->mem and make it a pointer")
> Signed-off-by: Harsh Parmar <kaii02ctf@gmail.com>

[Severity: Low]
In d3116756a710 ("drm/ttm: rename bo->mem and make it a pointer"),
ttm_bo_init_reserved() still unconditionally pointed bo->resource at the
embedded bo->_mem, so bo->resource could not be NULL on an initialized
buffer object.

Leaving bo->resource NULL when ttm_bo_init_reserved() is called with zero
placements was introduced by 180253782038 ("drm/ttm: stop allocating dummy
resources during BO creation"), and leaving it NULL after releasing backing
store in ttm_bo_pipeline_gutting() was introduced by c7ea16f6a47f
("drm/ttm: stop allocating a dummy resource for pipelined gutting").
Should the Fixes: tag reference those commits instead?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109202330.1816799-1-harshicon28@gmail.com?part=1