From nobody Mon Sep 28 07:24:46 2026 Received: from out203-205-221-190.mail.qq.com (out203-205-221-190.mail.qq.com [203.205.221.190]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C6AF73EFFD7 for ; Tue, 25 Aug 2026 09:30:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=203.205.221.190 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787650205; cv=none; b=Gj1xg3kuhiOxx/QvHXzM2DNbMkRmzn6cH/mwId70CsP3pllCPQue2f5tjTHKc2H77nDRox8lU29lgqMS8dSGafqgRykaNfSmXi1Fr8flx/m2qAdRq0AxC/hsA0xv6yVTWOSbnAzGxhU52gEqlxnhPputwWlaYEElGexN97bPf6I= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787650205; c=relaxed/simple; bh=PWLKdWWaI2jPcx8YxTfUdYf0ELiUgEUH09VaKGicck8=; h=Message-ID:Date:MIME-Version:To:Cc:From:Subject:Content-Type; b=S57eishixFc1Ywi42KnCApCola1CgmXSrd3ZaZYJs2v5CFsKEJMSxKRkY7Gv5ss2iQKzkD4QBSlKpEWuJe0ERunFCVesEw5vslQekm0Tntr8MVI+AlLsjYCiusgnpH2XC2bXMU3pXx+jVw6hl9ahot2N2fFWRv9CE2S7uVnWstM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=GBikoIL3; arc=none smtp.client-ip=203.205.221.190 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="GBikoIL3" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1787650194; bh=PWLKdWWaI2jPcx8YxTfUdYf0ELiUgEUH09VaKGicck8=; h=Date:To:Cc:From:Subject; b=GBikoIL359c92Lh0WaAb65RTefAqadljnBY6ohQobCvVF2hSnPBwS6iZP0C88fTLy aKjcu3gQDcNHe+XwjZTB+PYSlIpsr4/dvWxWjF8cV9cHnCaOecCnQSwrx7IfCdH1nn izRZm2fTdAusvnDeug6g4rVCmjTbaKuyFsT0fFwc= Received: from [192.168.255.10] ([111.206.96.146]) by newxmesmtplogicsvrszc56-0.qq.com (NewEsmtp) with SMTP id 7733AAF9; Tue, 25 Aug 2026 17:29:51 +0800 X-QQ-mid: xmsmtpt1787650191tphskq0w8 Message-ID: X-QQ-XMAILINFO: MMvVzQSdFuTppb02eZXtT0Vrl27MwY8Z9fPbj6GlfNDU9Ya1D7PLeQW1FgLyYS mtupIQ+PjAuGe+RBAk/E0cP9kqOdT8+SV0oVGck4wV0R7w3D8jiw2KbZ+To/CkTX77YqE7vJJJEL 4YPZSlYGdc+Cjf8mr95yJctLz74qfad64uPuJI9fN/HLS784JBMltOmET3ioepwpqYq6EHPqHREK s/5aZJWmxBn7pp3UkPYmYYfhngCqQIvzr6pWt8zElE6vUV640OHqDemkXvEvvjt89erhNePsKUlB m3y0N8kzCZEZfoCkPpZwkMeD9hmisCKQo4gIhw320hptDsWLal1mRz4qkW33beEwmIMCrfRFWKDK HXpgU4rH0OV3A9ndBYyzod7E38xWv8aKVkji9o6WNfDattrHtI1M0sfH3I4RmeImm2Sd7gNQPHHw j/9XlDOj1bcTGj2VuqpmbR3n8SR/7Tn0LBA9IcLCVbM5wQ1kcaWgQ0LLUqikBSYR2XYH9coEfyer LEJYzriq4Te74NX+oqrcBx/Zx7Y6x72vw7J6SwMsWMBG4d0AqhD4LiJYp78eh4yJwwVIhYqzzBrD 2uSttOiuqq4BNzZa3jOdUwKcfiN169GwnSY7yJI69hloICYFsIPBx2pFRdN4O7essyZ1kzICUf9F DGHm0QagRAsfO7FLyLtC0+QxXVktgZETHPEZmj3FoNW2FmzM5BOHWsRC1+5V6wTL3YJHw66/DXMM FkBWOV1r4dcSvEfxqqx1ED/1OMx1fYOiCsEW3295/ygsHJOZzzib8iEvOMbg3a6LhMaDnUOGJXEE DOJ+fDEdVIuK3xjB6hd2Owomt9nXuAcOOfgAOBo56xJ0OvDPYyK4f+lsIq7QAv0KknwrxcMHeKyQ TYWIkiqdhBOVvKFHmaIoJHgkouCDfXb9TcerkZLoyXUXdShtEUEYza+3Yj1M5isuPI7iPqL45N4z xhTtllDngC0+g2HBbRGlW9sdg/jUYbE+A9nrJNKbWU0ycAoUkUvPFobC49frBtXvpfmDIKLsZgsW lzELxFKf9tpKpJaqAPNvnmY/GPn+mlsr+ztpnT6U3tXDD9ijJ4GkeQ1OKIH5rp5Ez8QQi0W/iCk2 3jkTO18Jni9UfwtEwEN4y/wmu8fzO/CWLaTRkuj0lci5z9VEg= X-QQ-XMRINFO: OWPUhxQsoeAVwkVaQIEGSKwwgKCxK/fD5g== X-OQ-MSGID: <0ae2d2a2-8c16-43e0-bdf0-5e9d3ff99e46@qq.com> Date: Tue, 25 Aug 2026 17:29:50 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird To: alexander.deucher@amd.com, christian.koenig@amd.com Cc: airlied@gmail.com, Simona Vetter , Sunil Khatri , Prike Liang , =?UTF-8?Q?Timur_Krist=C3=B3f?= , Pierre-Eric Pelloux-Prayer , Mikhail Gavrilov , Srinivasan Shanmugam , Natalie Vock , amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org From: Yang Zi <2959243019@qq.com> Subject: [PATCH] drm/amdgpu: fix NULL pointer dereference in amdgpu_vm_init error path Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable In amdgpu_vm_init(), the error_free_root cleanup label runs amdgpu_vm_pt_free_root() before amdgpu_bo_unreserve(). However, amdgpu_vm_pt_free_root() walks the page table tree and frees each entry via amdgpu_vm_pt_free(), which calls amdgpu_bo_unref() on the root BO and clears vm->root.bo to NULL. The subsequent amdgpu_bo_unreserve(vm->root.bo) then dereferences a NULL pointer. Swap the two statements so that the root BO is unreserved before it is freed. This mirrors the success path at the end of the function, which unreserves before releasing its reference. Found by static analysis of the error handling path; the failure cases (dma_resv_reserve_fences() or amdgpu_vm_pt_clear() returning an error) trigger this path. Signed-off-by: Yang Zi <2959243019@qq.com> --- diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/a= mdgpu/amdgpu_vm.c index d2ad5b0e8759..dc72181ea0fa 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c @@ -2672,8 +2672,8 @@ int amdgpu_vm_init(struct amdgpu_device *adev, struct= amdgpu_vm *vm, =C2=A0 =C2=A0 =C2=A0return 0; =C2=A0 =C2=A0error_free_root: -=C2=A0 =C2=A0 amdgpu_vm_pt_free_root(adev, vm); =C2=A0 =C2=A0 =C2=A0amdgpu_bo_unreserve(vm->root.bo); +=C2=A0 =C2=A0 amdgpu_vm_pt_free_root(adev, vm); =C2=A0 =C2=A0 =C2=A0amdgpu_bo_unref(&root_bo); =C2=A0 =C2=A0error_free_delayed: