Re: [PATCH] drm/virtio: fix 0-byte blob ZERO_SIZE_PTR, GEM leak, and context_init rollback

[sashiko-bot@kernel.org]

> Fix multiple issues in virtio-gpu VRAM mapping, blob creation, and context
> initialization:
> 
> 1. In virtio_gpu_vram_mmap(), set vram->map_state = STATE_ERR if deferred
>    virtio_gpu_vram_map() fails so callers do not treat an unmapped VRAM
>    node as valid.
> 2. In verify_blob(), reject rc_blob->size == 0 or size values that wrap
>    PAGE_ALIGN() to prevent kvmalloc_array(0, ...) from returning
>    ZERO_SIZE_PTR.
> 3. In virtio_gpu_gem_create(), virtio_gpu_resource_create_ioctl(), and
>    virtio_gpu_resource_create_blob_ioctl(), use drm_gem_object_put()
>    instead of drm_gem_object_release() on error so the BO's free callback
>    is properly invoked.
> 4. In virtio_gpu_context_init_ioctl(), stage context parameters into local
>    variables and only commit them to vfpriv after all parameters and
>    ring_idx_mask have been validated.
> 
> Fixes: 16845c5d5409 ("drm/virtio: implement blob resources: implement vram object")
> Fixes: 85c83ea915ed ("drm/virtio: implement context init: allocate an array of fence contexts")
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260919215232.3470178-1-benquike@gmail.com?part=1