From nobody Mon Sep 28 07:18:12 2026 Received: from out203-205-221-202.mail.qq.com (out203-205-221-202.mail.qq.com [203.205.221.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 14F763911A8 for ; Tue, 25 Aug 2026 09:36:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=203.205.221.202 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787650589; cv=none; b=Bsgwjx9Im68Mvua+DwuE+UGopsXBXZh5H7DMycmP7fdsffR+YGI4SXkGUh8osPWFje/i31It5paz85uVK7nO76lFxdEBPqtlKtBohi8cCpoOQbClEx64OczVgmKODDxqLNfQNkT7Jajzf0x0t81q0ecqEacF/hXUF0YsVc+ot9U= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787650589; c=relaxed/simple; bh=PWLKdWWaI2jPcx8YxTfUdYf0ELiUgEUH09VaKGicck8=; h=Message-ID:Date:MIME-Version:To:Cc:From:Subject:Content-Type; b=ZLKUJZHm7qjakgZf2RKGoX9gqhlz7UdA7MJZf3jEM+aIx2tMl0M6V6p7R1HQpWNG/yNnGY+E5EJsZP5ckjUXIJ6xwbMHvPr+ovq4DYkRiWdzI4XFUDGWAIoDaPOnj/MBR6KXwAt8VLLz67W8Myyo2cBN18uKSXo65YauEoxtN9w= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=aRyBXA5+; arc=none smtp.client-ip=203.205.221.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="aRyBXA5+" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1787650584; bh=PWLKdWWaI2jPcx8YxTfUdYf0ELiUgEUH09VaKGicck8=; h=Date:To:Cc:From:Subject; b=aRyBXA5+SesmwQvqClu0bZ+zoszcSFaBpdwhzuq2j3XOmwGzfjr71xbozbKYDkr6l rrFlzgJvwLGcGoInLv2cOoX5jCN73Wc0TiisT6h2QZcrdZqzlkzYgAfIaP8nIb6Kzl o65uERvWUS4RJMe6Jlgpl7zcic4XPRdwDFz9WNLc= Received: from [192.168.255.10] ([111.206.96.150]) by newxmesmtplogicsvrszc56-0.qq.com (NewEsmtp) with SMTP id 915904B6; Tue, 25 Aug 2026 17:36:21 +0800 X-QQ-mid: xmsmtpt1787650581t9me5pmpc Message-ID: X-QQ-XMAILINFO: MYIgjB+F6BG8a5PFzh2c4y/5sXd1dGtBj7Y+z8RLxwkXr08O7Um1KBPMs66PkP Ahoodn2jSdfQN/rcUbRk/Z/R1dSWISYPc0cw/mQWCGXyYmGJXgOhkcaV4mY2BPWjigLlsP3tLmNf dzZKP2DMWAjKzNPMK8zb/MuokyI6c0A6cVNLuQJNKpP0tX1sN62hvFSsMRbbu7h1+Hz5Kl8JRPHy VTSdgIE7IaGWJUM/A9lx32nZ9kq5/EjncxhOBvcbjZV60E8EcHIkXJSEBB0qWxKoIPOCsNIHmIry 1IWmKjWg+kMuqIj4j1Ny2W7eDRbCpbsGeWQz8W4yDFZ6RfyveQPXwsqw+LUQxb05KQyp1icpv3dH 1jDYjCpZ1m9cspbcEQ73EZYalTBjAoOLtwrQQ0kZM9PAG3ej5R1D2TmRsG0AZovEqoO1njkvTOfl wcNN3sjhLDfQdClLrbIzJRGLrZCNVSkSIC7SST81EX2xwsBTzP1GkkG+lAQsZ2KWDIjS8tCSI5aG XEb9ilg069VW007zKOY+fNWNTI1DS0aGdei+pyqCiDXbQ9WjMhaz8WVeuUU5b3VwN285j5XjLVH/ IZk3AjMszXEUutTN2zJ0jazx6PknoYjPYr/VmiA7RnSxVV/tdwmZofffT+MpUTswVE9JMC8YjcBq 9P+8ZUqRI4t86R6HgpQ63P8U8gtlO0S+AyJMWKbcf00jM+PVXxT8EDDHMwRrgpXdO9a0Mtg9KuGa YqZUbI6KKfU3XjV+WDxdRujOaiUA9TEnEYmU/HSwJIbyN0Sb31z2ojnUrBYIBafvXtAVgzGLse56 FA+2UjiPVuyma/8w4dOg0Iw4Qfhg7l/T/vHCFEjH6mwWmnyowG6lr+XX9RkUx1oe1GkZ8tm+ZocL V9Okbjw6lQi0mx3QsGKvvSXSuZwYKgoWlDyclJKD6458BQ3zHmYA9hmu/Lzc4/eYUEeIWzmHxC0u qqrCyFs557uiVcrYzaWU1UyBCC4EUCxq0pKnLV2/Dsq8POoN0I2FRSukmIuOekVKVXbD1377YCQU KgZs5cZ2xKWiydtpWUAL6nMvZgAPqEKPGHu+ddZ5pDzem/hp3dn8UdnOHgoRhfFRzwxdlQmPsc3i zoHhqtQ5R7xOH0aKUKTGRaq6kT5Tj/ec3+oWVK1Kmzitc/Vswr4zKjFDw05g== X-QQ-XMRINFO: MPJ6Tf5t3I/ylTmHUqvI8+Wpn+Gzalws3A== X-OQ-MSGID: <43614503-2270-4aae-9d20-7dec42c6c7e7@qq.com> Date: Tue, 25 Aug 2026 17:36:20 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird To: alexander.deucher@amd.com, christian.koenig@amd.com Cc: amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org From: Yang Zi <2959243019@qq.com> Subject: [PATCH] drm/amdgpu: fix NULL pointer dereference in amdgpu_vm_init error path Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable In amdgpu_vm_init(), the error_free_root cleanup label runs amdgpu_vm_pt_free_root() before amdgpu_bo_unreserve(). However, amdgpu_vm_pt_free_root() walks the page table tree and frees each entry via amdgpu_vm_pt_free(), which calls amdgpu_bo_unref() on the root BO and clears vm->root.bo to NULL. The subsequent amdgpu_bo_unreserve(vm->root.bo) then dereferences a NULL pointer. Swap the two statements so that the root BO is unreserved before it is freed. This mirrors the success path at the end of the function, which unreserves before releasing its reference. Found by static analysis of the error handling path; the failure cases (dma_resv_reserve_fences() or amdgpu_vm_pt_clear() returning an error) trigger this path. Signed-off-by: Yang Zi <2959243019@qq.com> --- diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/a= mdgpu/amdgpu_vm.c index d2ad5b0e8759..dc72181ea0fa 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c @@ -2672,8 +2672,8 @@ int amdgpu_vm_init(struct amdgpu_device *adev, struct= amdgpu_vm *vm, =C2=A0 =C2=A0 =C2=A0return 0; =C2=A0 =C2=A0error_free_root: -=C2=A0 =C2=A0 amdgpu_vm_pt_free_root(adev, vm); =C2=A0 =C2=A0 =C2=A0amdgpu_bo_unreserve(vm->root.bo); +=C2=A0 =C2=A0 amdgpu_vm_pt_free_root(adev, vm); =C2=A0 =C2=A0 =C2=A0amdgpu_bo_unref(&root_bo); =C2=A0 =C2=A0error_free_delayed: