From nobody Sun Jun 14 23:02:27 2026 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1CFB3390CA6 for ; Sat, 11 Apr 2026 14:59:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775919568; cv=none; b=NvQGCOeY2UGKGSFb/d8eDhXW71px6/wvX/PUc+CfL8MNUqpQogL4uju6W8hJeieXIEn3clx6I+VGFAAQaE6PHqQCGuJUv63TewXtBAuGMwAnM9/gZF0oNW/d7gTspUdszcH7brC4axbYjh9ZaqYIoDaD15QZ4PKQJJcH/+bnaa0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775919568; c=relaxed/simple; bh=kys2+nhf6Ed5y0sTw19sLDV+jvztfPs0R/fXNp6raQM=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=A4yiKiK0KfgoaMDInve6CvytKW0BCMAAvgErxAm2Xdzd0ggWLOhuOHSjMUVXycGtYLzFDE87jNatH5idSXb2Y+qc/IzP/l+V9KJ/XvvCSP0263lnCShy6vb7z0CMKaeMVRyPjx4cSi/Hx77A2udVUEcYfMmwTH0X/HqJGvReySU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=iaD8qEr7; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=MVGdn7fE; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="iaD8qEr7"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="MVGdn7fE" Received: from pps.filterd (m0279862.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 63BDIDrN1753404 for ; Sat, 11 Apr 2026 14:59:18 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:message-id :mime-version:subject:to; s=qcppdkim1; bh=7Nb/AjyriPfrtpiJurQyhh BOLNHKNPTN1zEcDyx9jfQ=; b=iaD8qEr7s6n89iZHreQI/MKz3+47pqtv9ssTIw ih29ff7tWOEMFhlQbFq8GsMg63sEdVLXhjq043gUtUlNkqqMGoIjtdH3vGV0bfO6 rVjWepvu0WxH03GaRHmpkAvkQuG1cShkYV7BvqYlzEtkwchudP5LBbR7qXThAOsB jT03zTdW9coSidvaA3HQ8kVMCYP1/+eCKPtpNGGYkjFfPbAFjSO3Mvhwt1VWcuee q43JrL2PFuPiaUh6Aias7FJwq023uYMC1kxJYWpMmbyimQQbrIPW++I7E35t5KhX 0UJPkcZ7lMKQwZmuIzL2dirwfHH/j4HCQi5L1AwYwzlzV7Ag== Received: from mail-qt1-f198.google.com (mail-qt1-f198.google.com [209.85.160.198]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4dff2b8vc7-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Sat, 11 Apr 2026 14:59:18 +0000 (GMT) Received: by mail-qt1-f198.google.com with SMTP id d75a77b69052e-50b4661881eso34453981cf.0 for ; Sat, 11 Apr 2026 07:59:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1775919557; x=1776524357; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:from:to:cc:subject:date:message-id:reply-to; bh=7Nb/AjyriPfrtpiJurQyhhBOLNHKNPTN1zEcDyx9jfQ=; b=MVGdn7fEOsgwIPAXVBZrmBHXfPzBOyJB8Ilc4y/B2+o3bQxRMrgjhVrla5Bq8F8HGg oPJAFJ7/F0ORBE2sOI4Gx/Zc8yBOJ185YZAzGFf22YHoGx5IoECg2W/FcGM5JUP7VTdH 4FYvJXX6/rmd/+nwKlqRFr8vVjeZwsX13Pt0+Eoj/pThixMZ/XVWhjdTZpbO8yPObN11 msD2JljmMvzDjQVkCfHG10Mj9k2ZylbLDh+FctZ/An9J7gHRXVeeXwM9u3nofRRhD+fy PiI8GjQsyjBnDKVQ3e1y8FLtwV1yXQL0FI8HqTDyLFpTM838ZPgTPW8VsW9RTj12DY+Z DC1w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775919557; x=1776524357; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=7Nb/AjyriPfrtpiJurQyhhBOLNHKNPTN1zEcDyx9jfQ=; b=ChsvwK5XfdtxDTzgZEhxrbRJilBR9uYS87QEdwYtEa8Gx1zapqm/tdmvejLMFE5MbQ Yg/R1glgBa+KmGgnWIbkOGI2oLEn6iprTO7aXoztIPx4sb/seRLvjJ/1lDfzD/nI546H gQokMxnkVQy2Gsps4D0TPo9RF/VzJwH9zHlMoJb1zQrVJbQENuIjagthn0WGjpJ1QwYi /pAxaziz6iBOPdP3mRGa+fTHaHuHWMPQMFTLpvq5LkfKvgBp7tB71+yiK+S4LxB0sNdd Nl9tgnqMMgXWaTMsqoJWsJoauKOjtN8i91xou0TpczwY+0bkFHxjbRpODBOUtzNRUMUb cEYg== X-Forwarded-Encrypted: i=1; AJvYcCVsQ1ObcVJ1CTCM809FBeLUMrFWVkMI8FBX5PhHgSzNHaomS2lkgNLVGw7/FufOmPgVIGcMv+NY2WwHrg0=@vger.kernel.org X-Gm-Message-State: AOJu0YxJ9xc4qZrjn1N/bzMSnSdgWjaxyRIPmxeKS7lZ1l4CHXRMQLOt U0EGSfPBSsiMOAb/87S1yb6oyhnsmxk5S4wGXUUjxgJa/vmWbuKTWbtMCD8MhYrKK83CmiiNdpq Pi045HzvXfADBxOCitmS4Sv8biRaOLmJ0otktqbbEDeeeFDgs4vs12Rqx69WrH4d429s= X-Gm-Gg: AeBDietN5/lf5K2uzrOyINHIkvsZPQeMdfYfwny6Ftc2P7xhKHalJxcrmEnC8FfKaPE SBPpOeNr2FZNjLY6ZZDdYlxUpTrxWdWGN4hOaBo0ZW+hOkQyyZjwlThXUmgNa+pu5Sh3OYLES8v pUmr3/mqPMj6yQSAUbPujb5cWAgpcDNFjx/aLALznzpp2jq/ur9BFPfOiN4NNVx1Nyd+eoRPU1i uAITsB8dNUg/UuAJfVTGI1Ok+if/Udxu9cl47oX+y2cp/VDOkVx+b5ZSHuHX7/F9UFXr7ihF9RQ rF797+KQo6R2YyXDV5k9B/+i1brEaWiH+842fztGmhAOpl9l/T4gdvnAlGEQ9MHr+QrezleyXph TOtsVYT3lIjvxTBFZSXtCnRYYg+RdF01eq3XqWJSBg07ItvYq6s3835Zj1x46GXEQBI/lJzV1Zs qs1G3rJROQrwQ+vmsxOzS/tZdEi2iv15I5HWk= X-Received: by 2002:a05:622a:8a0b:b0:50d:8c22:47f2 with SMTP id d75a77b69052e-50dd5bdb454mr85336881cf.44.1775919557156; Sat, 11 Apr 2026 07:59:17 -0700 (PDT) X-Received: by 2002:a05:622a:8a0b:b0:50d:8c22:47f2 with SMTP id d75a77b69052e-50dd5bdb454mr85336631cf.44.1775919556623; Sat, 11 Apr 2026 07:59:16 -0700 (PDT) Received: from umbar.lan (2001-14ba-a073-af00-264b-feff-fe8b-be8a.rev.dnainternet.fi. [2001:14ba:a073:af00:264b:feff:fe8b:be8a]) by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-5a3eeee12fesm1448241e87.40.2026.04.11.07.59.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 11 Apr 2026 07:59:15 -0700 (PDT) From: Dmitry Baryshkov Date: Sat, 11 Apr 2026 17:59:15 +0300 Subject: [PATCH v3] drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260411-adreno-fix-ubwc-v3-1-4983156f3f80@oss.qualcomm.com> X-B4-Tracking: v=1; b=H4sIAMJh2mkC/4WNQQ7CIBBFr9KwlgYoBXXlPYwLoFOLsUWhRU3Tu wt1q3Ezycv8//6MAngLAe2LGXmINlg3JKg2BTKdGs6AbZMYMcIE4URi1XgYHG7tE0/6YbBQrBZ cUgKMotS6eUi/1Xg8fThM+gJmzJqc6GwYnX+tk5Hm3G97pJhirZkmO14TvZUHF0J5n9TVuL4v0 0F5JLI/GpY0sm1lJRgXVQ1fNMuyvAHmcLM7DgEAAA== X-Change-ID: 20260407-adreno-fix-ubwc-6a2564710e21 To: Rob Clark , Sean Paul , Konrad Dybcio , Akhil P Oommen , Dmitry Baryshkov , Abhinav Kumar , Jessica Zhang , Marijn Suijten , David Airlie , Simona Vetter Cc: linux-arm-msm@vger.kernel.org, dri-devel@lists.freedesktop.org, freedreno@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.15.1 X-Developer-Signature: v=1; a=openpgp-sha256; l=2141; i=dmitry.baryshkov@oss.qualcomm.com; h=from:subject:message-id; bh=kys2+nhf6Ed5y0sTw19sLDV+jvztfPs0R/fXNp6raQM=; b=owEBbQGS/pANAwAKAYs8ij4CKSjVAcsmYgBp2mHChdpc2ZTtjwLHakNI5nxuTlXVhd8s17y1Q iiisyu6/wGJATMEAAEKAB0WIQRMcISVXLJjVvC4lX+LPIo+Aiko1QUCadphwgAKCRCLPIo+Aiko 1XxlB/9SbltxguzGNBXkgiFsdlDDC6QEegF2crxUCwPsq+z8hKBz8QsLVNoiLsfl+odFIc998fH KNqR9iHctqylW7Fvqu4K9+yoPegTZvOpdn4xMDJwCNhUvTS/Ye3TtNWMqtWAYZTU3YCykmdG3eW ZS0JXU0MApA5zVnZUewCGb0YWPOniQgP3FZdD12rf166eJWt9HY0uLH69zCgHVte9z/BPjsa3Hj 0j9OZIWoPyITef1DnHVN83eJrp/ZSYj4UMqJismGlPXdNWfFpEwO3Bm0rPFcBSA5bUzB742t8/a zlM3aMhF/qQj6OtZ6UHRA6QokKIV8HmCsJg3CZ/pNam1tWZS X-Developer-Key: i=dmitry.baryshkov@oss.qualcomm.com; a=openpgp; fpr=8F88381DD5C873E4AE487DA5199BF1243632046A X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNDExMDEyOSBTYWx0ZWRfXxogMyySlitJ9 zF4MiRVVK24KHHZlNj7k2cujsUYR+7rfBSBrad9GgFeNnOzOd+kpqtALwtecdmKQXkQviAbuqP7 1D1rcPGFquKsq6iS6dj10OG76AtDv2tmakgpMT/iokbYsUfQmUMQ5ZJTHIEzxrWow+trt3dHzjq 9TPCrQTsVgzUNKgAJ2HFTmXCLKruSl6Q7lhgrRZOeo1Ud4yFypb8AEw8qkpkiFhkxwN+GBurMvv kS3Pkb5OH1v3Zw4DG+3FAVqS4aCCSS60WlYnU3LOq8dFyMlUBxyKFm84Ub2yN2tQuJkmoGibL5k Iy/wAa1LSouWwXE8h/L66sM/Hlmb6hIk2CztGBUCsy4Yg7NP0h0/UW15mINgEzjxPk8xpF0m3QJ 0Yr+PZbX3V09t9aRdER7oBdXQtKFLJrU9o6/kfEe57LMSYLM8ximaLmj57x+z81tmd/CAJMGyyv CLSzw3xhm89IiY3t8oQ== X-Proofpoint-GUID: QmyoBkeCNx8qObaDC7KJhAD0uQCbXpDf X-Proofpoint-ORIG-GUID: QmyoBkeCNx8qObaDC7KJhAD0uQCbXpDf X-Authority-Analysis: v=2.4 cv=W4gIkxWk c=1 sm=1 tr=0 ts=69da61c6 cx=c_pps a=mPf7EqFMSY9/WdsSgAYMbA==:117 a=xqWC_Br6kY4A:10 a=IkcTkHD0fZMA:10 a=A5OVakUREuEA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=_K5XuSEh1TEqbUxoQ0s3:22 a=bC-a23v3AAAA:8 a=EUspDBNiAAAA:8 a=uq7AuM9elF0DF7tEa_4A:9 a=QEXdDO2ut3YA:10 a=dawVfQjAaf238kedN5IG:22 a=FO4_E8m0qiDe52t0p3_H:22 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-04-11_04,2026-04-09_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 bulkscore=0 spamscore=0 clxscore=1015 phishscore=0 impostorscore=0 lowpriorityscore=0 priorityscore=1501 malwarescore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2604010000 definitions=main-2604110129 Before a5xx Adreno driver will not try fetching UBWC params (because those generations didn't support UBWC anyway), however it's still possible to query UBWC-related params from the userspace, triggering possible NULL pointer dereference. Check for UBWC config in adreno_get_param() and return sane defaults if there is none. Fixes: a452510aad53 ("drm/msm/adreno: Switch to the common UBWC config stru= ct") Signed-off-by: Dmitry Baryshkov Reviewed-by: Rob Clark --- Changes in v3: - Switched to UERR (Rob) - Link to v2: https://patch.msgid.link/20260407-adreno-fix-ubwc-v2-1-7ff736= 24635e@oss.qualcomm.com Changes in v2: - Changed adreno_get_param() return -ENOENT for affected params (Rob) - Link to v1: https://patch.msgid.link/20260407-adreno-fix-ubwc-v1-1-bb2b09= 450b87@oss.qualcomm.com --- drivers/gpu/drm/msm/adreno/adreno_gpu.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/= adreno/adreno_gpu.c index 66f80f2d12f9..02f60b33ea1d 100644 --- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c +++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c @@ -424,15 +424,21 @@ int adreno_get_param(struct msm_gpu *gpu, struct msm_= context *ctx, *value =3D vm->mm_range; return 0; case MSM_PARAM_HIGHEST_BANK_BIT: + if (!adreno_gpu->ubwc_config) + return UERR(ENOENT, drm, "no UBWC on this platform"); *value =3D adreno_gpu->ubwc_config->highest_bank_bit; return 0; case MSM_PARAM_RAYTRACING: *value =3D adreno_gpu->has_ray_tracing; return 0; case MSM_PARAM_UBWC_SWIZZLE: + if (!adreno_gpu->ubwc_config) + return UERR(ENOENT, drm, "no UBWC on this platform"); *value =3D adreno_gpu->ubwc_config->ubwc_swizzle; return 0; case MSM_PARAM_MACROTILE_MODE: + if (!adreno_gpu->ubwc_config) + return UERR(ENOENT, drm, "no UBWC on this platform"); *value =3D adreno_gpu->ubwc_config->macrotile_mode; return 0; case MSM_PARAM_UCHE_TRAP_BASE: --- base-commit: 66672af7a095d89f082c5327f3b15bc2f93d558e change-id: 20260407-adreno-fix-ubwc-6a2564710e21 Best regards, -- =20 With best wishes Dmitry