[PATCH V1] accel/amdxdna: Fix potential NULL pointer access in amdxdna_gem_vmap()

[PATCH V1] accel/amdxdna: Fix potential NULL pointer access in amdxdna_gem_vmap()

[Lizhi Hou]

If the heap BO was never vmapped before its handle was closed and the
user then vmaps the dev BO (which triggers amdxdna_gem_vmap(heap_bo)),
and drm_gem_vmap fails — NULL pointer dereference at abo->client->xdna.

Fix it by get xdna pointer through to_xdna_dev(to_gobj(abo)->dev).

Fixes: d76856beb4a4 ("accel/amdxdna: Refactor GEM BO handling and add helper APIs for address retrieval")
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
---
 drivers/accel/amdxdna/amdxdna_gem.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/accel/amdxdna/amdxdna_gem.c b/drivers/accel/amdxdna/amdxdna_gem.c
index 64c7d82713b0..5033a0e5c6ab 100644
--- a/drivers/accel/amdxdna/amdxdna_gem.c
+++ b/drivers/accel/amdxdna/amdxdna_gem.c
@@ -198,6 +198,7 @@ amdxdna_gem_destroy_obj(struct amdxdna_gem_obj *abo)
  */
 void *amdxdna_gem_vmap(struct amdxdna_gem_obj *abo)
 {
+	struct amdxdna_dev *xdna = to_xdna_dev(to_gobj(abo)->dev);
 	struct iosys_map map = IOSYS_MAP_INIT_VADDR(NULL);
 	int ret;
 
@@ -210,7 +211,7 @@ void *amdxdna_gem_vmap(struct amdxdna_gem_obj *abo)
 	if (!abo->mem.kva) {
 		ret = drm_gem_vmap(to_gobj(abo), &map);
 		if (ret)
-			XDNA_ERR(abo->client->xdna, "Vmap bo failed, ret %d", ret);
+			XDNA_ERR(xdna, "Vmap bo failed, ret %d", ret);
 		else
 			abo->mem.kva = map.vaddr;
 	}
-- 
2.34.1

Re: [PATCH V1] accel/amdxdna: Fix potential NULL pointer access in amdxdna_gem_vmap()

[Max Zhen]

On 7/7/2026 Tue 10:23, Lizhi Hou wrote:
> If the heap BO was never vmapped before its handle was closed and the
> user then vmaps the dev BO (which triggers amdxdna_gem_vmap(heap_bo)),
> and drm_gem_vmap fails — NULL pointer dereference at abo->client->xdna.
> 
> Fix it by get xdna pointer through to_xdna_dev(to_gobj(abo)->dev).
> 
> Fixes: d76856beb4a4 ("accel/amdxdna: Refactor GEM BO handling and add helper APIs for address retrieval")
> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Reviewed-by: Max Zhen <max.zhen@amd.com>
> ---
>   drivers/accel/amdxdna/amdxdna_gem.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/accel/amdxdna/amdxdna_gem.c b/drivers/accel/amdxdna/amdxdna_gem.c
> index 64c7d82713b0..5033a0e5c6ab 100644
> --- a/drivers/accel/amdxdna/amdxdna_gem.c
> +++ b/drivers/accel/amdxdna/amdxdna_gem.c
> @@ -198,6 +198,7 @@ amdxdna_gem_destroy_obj(struct amdxdna_gem_obj *abo)
>    */
>   void *amdxdna_gem_vmap(struct amdxdna_gem_obj *abo)
>   {
> +	struct amdxdna_dev *xdna = to_xdna_dev(to_gobj(abo)->dev);
>   	struct iosys_map map = IOSYS_MAP_INIT_VADDR(NULL);
>   	int ret;
>   
> @@ -210,7 +211,7 @@ void *amdxdna_gem_vmap(struct amdxdna_gem_obj *abo)
>   	if (!abo->mem.kva) {
>   		ret = drm_gem_vmap(to_gobj(abo), &map);
>   		if (ret)
> -			XDNA_ERR(abo->client->xdna, "Vmap bo failed, ret %d", ret);
> +			XDNA_ERR(xdna, "Vmap bo failed, ret %d", ret);
>   		else
>   			abo->mem.kva = map.vaddr;
>   	}

Re: [PATCH V1] accel/amdxdna: Fix potential NULL pointer access in amdxdna_gem_vmap()

[Lizhi Hou]

On 7/7/26 10:29, Max Zhen wrote:
>
>
> On 7/7/2026 Tue 10:23, Lizhi Hou wrote:
>> If the heap BO was never vmapped before its handle was closed and the
>> user then vmaps the dev BO (which triggers amdxdna_gem_vmap(heap_bo)),
>> and drm_gem_vmap fails — NULL pointer dereference at abo->client->xdna.
>>
>> Fix it by get xdna pointer through to_xdna_dev(to_gobj(abo)->dev).
>>
>> Fixes: d76856beb4a4 ("accel/amdxdna: Refactor GEM BO handling and add 
>> helper APIs for address retrieval")
>> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
> Reviewed-by: Max Zhen <max.zhen@amd.com>

Thanks a lot for reviewing the patch. Sashiko bot reports other places 
which can trigger abo->client NULL pointer dereference. I will create a 
V2 patch which fix those places as well.

Lizhi

>> ---
>>   drivers/accel/amdxdna/amdxdna_gem.c | 3 ++-
>>   1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/accel/amdxdna/amdxdna_gem.c 
>> b/drivers/accel/amdxdna/amdxdna_gem.c
>> index 64c7d82713b0..5033a0e5c6ab 100644
>> --- a/drivers/accel/amdxdna/amdxdna_gem.c
>> +++ b/drivers/accel/amdxdna/amdxdna_gem.c
>> @@ -198,6 +198,7 @@ amdxdna_gem_destroy_obj(struct amdxdna_gem_obj *abo)
>>    */
>>   void *amdxdna_gem_vmap(struct amdxdna_gem_obj *abo)
>>   {
>> +    struct amdxdna_dev *xdna = to_xdna_dev(to_gobj(abo)->dev);
>>       struct iosys_map map = IOSYS_MAP_INIT_VADDR(NULL);
>>       int ret;
>>   @@ -210,7 +211,7 @@ void *amdxdna_gem_vmap(struct amdxdna_gem_obj 
>> *abo)
>>       if (!abo->mem.kva) {
>>           ret = drm_gem_vmap(to_gobj(abo), &map);
>>           if (ret)
>> -            XDNA_ERR(abo->client->xdna, "Vmap bo failed, ret %d", ret);
>> +            XDNA_ERR(xdna, "Vmap bo failed, ret %d", ret);
>>           else
>>               abo->mem.kva = map.vaddr;
>>       }
>