Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] Missing NULL check for the return value of `msm_context_vm()` causes a kernel panic when dereferencing the shared resv object. -- --- Patch [12]: [PATCH v7 12/17] drm/msm/gem: Set resv before exposing obj --- commit 1309e8291ed5a0d77adef43c83bb315bbd37c9af Author: Rob Clark <[email protected]> drm/msm/gem: Set resv before exposing obj Don't swap the resv object _after_ exposing the newly created obj in LRU or global objects list, as that creates a race condition where another thread could lock the object using the original (per-obj) resv, but then unlock after the resv is replaced. > diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c > index 3c36b1c4a4d59..535c6e1acb3c1 100644 > --- a/drivers/gpu/drm/msm/msm_gem.c > +++ b/drivers/gpu/drm/msm/msm_gem.c [ ... ] > @@ -1136,10 +1136,17 @@ int msm_gem_new_handle(struct drm_device *dev, struct > drm_file *file, > size_t size, uint32_t flags, uint32_t *handle, > char *name) > { > - struct drm_gem_object *obj; > + struct drm_gem_object *obj, *r_obj = NULL; > int ret; > > - obj = msm_gem_new(dev, size, flags); > + if (flags & MSM_BO_NO_SHARE) { > + struct msm_context *ctx = file->driver_priv; > + struct drm_gpuvm *vm = msm_context_vm(dev, ctx); > + > + r_obj = drm_gpuvm_resv_obj(vm); [Severity: High] This is a pre-existing issue, but does this code need a NULL check for vm before dereferencing it to access the shared resv object? If userspace passes the MSM_BO_NO_SHARE flag in a display-only configuration where no GPU is attached, msm_context_vm() will return NULL. Passing that NULL pointer into the drm_gpuvm_resv_obj() macro leads to an immediate kernel panic. Before this patch, the code directly dereferenced ctx->vm which would also be NULL on display-only setups, so this problem wasn't introduced here but remains present. -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=12
