On Fri, Jun 12, 2026 at 10:12 PM Mario Limonciello <[email protected]> wrote: > > The AMDGPU_GEM_OP_GET_MAPPING_INFO path of amdgpu_gem_op_ioctl() looks > up the bo_va for the buffer object in the caller's VM via > amdgpu_vm_bo_find(), but uses the returned pointer without checking it. > > amdgpu_vm_bo_find() returns NULL when the BO has no bo_va in that VM, > which is the normal case for a BO that has never been mapped. The result > is fed straight into amdgpu_vm_bo_va_for_each_valid_mapping(), which > expands to list_for_each_entry(mapping, &(bo_va)->valids, list) and > dereferences bo_va, causing a NULL pointer dereference. > > This is reachable by any process able to issue the ioctl (render group) > simply by requesting mapping info for an unmapped BO. > > Return -ENOENT when no bo_va is found, jumping to out_exec so the > drm_exec context and GEM object reference are released. > > Fixes: 4d82724f7f2b ("drm/amdgpu: Add mapping info option for GEM_OP ioctl") > Signed-off-by: Mario Limonciello <[email protected]>
Reviewed-by: Alex Deucher <[email protected]> > --- > drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c > b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c > index 22ec4eb6e17f8..28f89ae8ca745 100644 > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c > @@ -1094,6 +1094,11 @@ int amdgpu_gem_op_ioctl(struct drm_device *dev, void > *data, > * If that number is larger than the size of the array, the > ioctl must > * be retried. > */ > + if (!bo_va) { > + r = -ENOENT; > + goto out_exec; > + } > + > if (args->num_entries > INT_MAX / sizeof(*vm_entries)) { > r = -EINVAL; > goto out_exec; > -- > 2.43.0 >
