AMDGPU_GEM_OP_GET_MAPPING_INFO looks up the BO's VM mapping and then iterates the valid and invalid mapping lists unconditionally. A GEM BO can be queried before it has been mapped into the file VM, in which case amdgpu_vm_bo_find() returns NULL and the list walk dereferences it.
Return -ENOENT for an unmapped BO, matching the VA operation path that already rejects missing BO-VA state before touching the mapping lists. Signed-off-by: Yousef Alhouseen <[email protected]> --- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c index 212c14d99..4b2699931 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c @@ -1087,6 +1087,12 @@ int amdgpu_gem_op_ioctl(struct drm_device *dev, void *data, struct drm_amdgpu_gem_vm_entry *vm_entries; struct amdgpu_bo_va_mapping *mapping; int num_mappings = 0; + + if (!bo_va) { + r = -ENOENT; + goto out_exec; + } + /* * num_entries is set as an input to the size of the user-allocated array of * drm_amdgpu_gem_vm_entry stored at args->value. -- 2.54.0
