Re: [PATCH v1 4/4] drm/xe/kunit: Add tests for PF-mem regions

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] If `devm_ioremap_wc()` fails, `vram->mapping` is incorrectly initialized to an invalid non-NULL pointer when `offset > 0`, leading to downstream kernel panics.
--

--- Patch [4]: [PATCH v1 4/4] drm/xe/kunit: Add tests for PF-mem regions ---
commit e9c2a7426069b7396e0ca724779e07a5d5cec440
Author: Piotr Piórkowski <piotr.piorkowski@intel.com>

drm/xe/kunit: Add tests for PF-mem regions
    
Add coverage for PF-mem VRAM region metadata, bounds checking, and
full, partial, and missing CPU visibility.

> diff --git a/drivers/gpu/drm/xe/tests/xe_vram.c b/drivers/gpu/drm/xe/tests/xe_vram.c
> new file mode 100644
> index 0000000000000..36a49fbef2206
> --- /dev/null
> +++ b/drivers/gpu/drm/xe/tests/xe_vram.c
> @@ -0,0 +1,115 @@
> +// SPDX-License-Identifier: GPL-2.0 AND MIT
> +/*
> + * Copyright © 2026 Intel Corporation
> + */

[ ... ]

> +static void pfmem_create(struct kunit *test)
> +{
> +	struct xe_device *xe = test->priv;
> +	struct xe_vram_region parent = pfmem_parent(xe, SZ_64M);
> +	struct xe_vram_region *vram;
> +
> +	vram = xe_vram_region_alloc_pfmem(xe, 0);
> +	KUNIT_ASSERT_NOT_NULL(test, vram);
> +	KUNIT_ASSERT_EQ(test, xe_vram_region_init_pfmem(vram, &parent, SZ_4M, SZ_16M), 0);

[Severity: High]
This is a pre-existing issue, but does the underlying initialization logic
have an unchecked mapping issue?

If devm_ioremap_wc() fails in determine_lmem_bar_size(), it returns NULL,
but determine_lmem_bar_size() doesn't check for this and returns 0 (success).

Later, vram_region_init() executes:

    vram->mapping = lmem_bar->mapping + offset;

If lmem_bar->mapping is NULL, this pointer arithmetic creates a non-NULL
invalid pointer when offset > 0 (which happens for non-zero tiles or when
initializing a PF-mem region via xe_vram_region_init_pfmem() called here).

Because vram->mapping is no longer NULL, subsequent checks like
if (vram->mapping) evaluate to true, leading to a kernel panic when the
invalid pointer is dereferenced.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260813102511.200690-1-piotr.piorkowski@intel.com?part=4