Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [Critical] Valid DMA address 0 is leaked because `drm_pagemap_migrate_unmap_pages` skips unmapping when `pagemap_addr[i].addr == 0`, leading to a stale IOMMU mapping and potential use-after-free. -- --- Patch [4]: [PATCH v3 4/6] drm/pagemap: dma-unmap pages before handling migration errors --- commit 449a54e82e1a7fd00fc19c70ae34414088711db1 Author: Matthew Brost <[email protected]> drm/pagemap: dma-unmap pages before handling migration errors This commit reorders the cleanup sequence during migration errors. It ensures that DMA unmapping occurs before the pages array is cleared, preventing missing unmaps due to invalid page information. > diff --git a/drivers/gpu/drm/drm_pagemap.c b/drivers/gpu/drm/drm_pagemap.c > index 892b325fa99b8..aef1fcea663d5 100644 > --- a/drivers/gpu/drm/drm_pagemap.c > +++ b/drivers/gpu/drm/drm_pagemap.c > @@ -1175,12 +1175,12 @@ int drm_pagemap_evict_to_ram(struct > drm_pagemap_devmem *devmem_allocation) > goto err_finalize; > > err_finalize: > + drm_pagemap_migrate_unmap_pages(devmem_allocation->dev, pagemap_addr, > dst, npages, > + DMA_FROM_DEVICE, &state); [Severity: Critical] This is a pre-existing issue, but does the check inside drm_pagemap_migrate_unmap_pages() accidentally leak valid DMA address 0? drivers/gpu/drm/drm_pagemap.c:drm_pagemap_migrate_unmap_pages() { ... if (!page || !pagemap_addr[i].addr || dma_mapping_error(dev, pagemap_addr[i].addr)) goto next; ... } Since 0 is a valid DMA address on many platforms, skipping the unmap when pagemap_addr[i].addr == 0 might leave a stale IOMMU mapping. When the page is subsequently freed, could a malicious userspace instruct the GPU to access this DMA address and cause memory corruption or an IOMMU use-after-free? > if (err) > drm_pagemap_migration_unlock_put_pages(npages, dst); > migrate_device_pages(src, dst, npages); > migrate_device_finalize(src, dst, npages); > - drm_pagemap_migrate_unmap_pages(devmem_allocation->dev, pagemap_addr, > dst, npages, > - DMA_FROM_DEVICE, &state); > > err_free: > kvfree(buf); -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=4
