Re: [PATCH v5 02/14] drm/panic: Test address from kmap op for NULL

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing NULL checks for page pointers passed to kmap_local_page_try_from_panic() leads to a kernel panic in the panic handler.
--

commit 69a5d51433b94a040beb8954801343ad106c13c9
Author: Thomas Zimmermann <tzimmermann@suse.de>

drm/panic: Test address from kmap op for NULL

Do nothing if kmap_local_page_try_from_panic() returns NULL. This is
not likely to hapen, as the previous page from the same memory area
has been mapped successfully.

Cc: Javier Martinez Canillas <javierm@redhat.com>
Cc: Jocelyn Falempe <jfalempe@redhat.com>
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v6.18+

> diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c
> index ba21df4be3380..d28ce8878e055 100644
> --- a/drivers/gpu/drm/drm_panic.c
> +++ b/drivers/gpu/drm/drm_panic.c
> @@ -178,6 +178,8 @@ static void drm_panic_write_pixel24_xpage(void *vaddr, struct page *next_page,
>  	u8 *p = vaddr + offset;
>  
>  	vaddr2 = kmap_local_page_try_from_panic(next_page);

[Severity: High]
This isn't a bug introduced by this patch, but can next_page be NULL here,
leading to a kernel panic?

If a scanout buffer is sparse or partially unpinned, the pages array might
contain NULL pointers. While drm_panic_blit_page() checks for NULL before
most operations, when a 24-bit pixel crosses a page boundary it calls
drm_panic_write_pixel24_xpage(vaddr, pages[page + 1], ...).

If pages[page + 1] is NULL, passing it to kmap_local_page_try_from_panic()
causes a fatal page fault when attempting to dereference the page pointer.

Additionally, drm_panic_fill_page() seems to omit the page validation
entirely and passes pages[page] directly to kmap_local_page_try_from_panic():

drivers/gpu/drm/drm_panic.c:drm_panic_fill_page() {
    ...
    vaddr = kmap_local_page_try_from_panic(pages[page]);
    ...
}

Should the page pointers be validated before attempting to map them?

> +	if (!vaddr2)
> +		return;
>  
>  	*p++ = color & 0xff;
>  	color >>= 8;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260911124540.279841-1-tzimmermann@suse.de?part=2