[PATCH] drm/panthor: Fix unlocked pool->vm access in panthor_heap_create()

[PATCH] drm/panthor: Fix unlocked pool->vm access in panthor_heap_create()

[Jiwoo Kim]

panthor_heap_create() takes a reference on pool->vm under pool->lock,
because the pool can be destroyed concurrently, and the initial heap
chunks used to be allocated in that VM. Since commit c63c3bfdde26
("drm/panthor: Avoid sleep locking in the internal BO size path"),
panthor_alloc_heap_chunk() takes the pool instead and reads pool->vm
itself. panthor_heap_grow() calls it with pool->lock held, but
panthor_heap_create() does not, so pool->vm is read without the lock
for every initial chunk.

If TILER_HEAP_CREATE races with VM_DESTROY on the same VM,
panthor_vm_destroy() calls panthor_heap_pool_destroy(), which sets
pool->vm to NULL, and panthor_kernel_bo_create() can then be called
with a NULL VM, which hits its drm_WARN_ON(!vm) and fails with
-EINVAL.

Pass the VM to panthor_alloc_heap_chunk() and
panthor_alloc_heap_chunks() again: panthor_heap_create() passes the VM
it holds a reference on, and panthor_heap_grow() passes pool->vm, which
it reads under pool->lock. In the race above, the initial chunks are
then created in the destroyed but still referenced VM, and
panthor_heap_create() frees them and fails with -EINVAL when it finds
the pool destroyed under pool->lock, as it did before that commit.

The problem was found through AI-assisted source code review. The fix
is compile-tested only and there is no reproducer, as I don't have
Mali CSF hardware.

Fixes: c63c3bfdde26 ("drm/panthor: Avoid sleep locking in the internal BO size path")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Jiwoo Kim <arpe1618@gmail.com>
---

Notes:
    This is the follow-up mentioned in "[PATCH] drm/panthor: Don't access
    gpu_contexts of a destroyed heap pool":
    https://lore.kernel.org/all/20261113162648.110226253-1-arpe1618@gmail.com/
    The two patches are independent and apply in either order.
    
    It conflicts with Osama Abdelkader's pending "drm/panthor: Fix race
    when retrieving the new chunk in panthor_heap_grow()", which also
    changes the panthor_alloc_heap_chunk() arguments. I can rebase on top
    of it if it lands first.

 drivers/gpu/drm/panthor/panthor_heap.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/panthor/panthor_heap.c b/drivers/gpu/drm/panthor/panthor_heap.c
index 99311abdf1..46f53699a2 100644
--- a/drivers/gpu/drm/panthor/panthor_heap.c
+++ b/drivers/gpu/drm/panthor/panthor_heap.c
@@ -137,7 +137,12 @@ static void panthor_free_heap_chunk(struct panthor_heap_pool *pool,
 	kfree(chunk);
 }
 
+/*
+ * @vm must be pool->vm read under pool->lock, or a reference taken from it
+ * under that lock: panthor_heap_pool_destroy() clears pool->vm.
+ */
 static int panthor_alloc_heap_chunk(struct panthor_heap_pool *pool,
+				    struct panthor_vm *vm,
 				    struct panthor_heap *heap,
 				    bool initial_chunk)
 {
@@ -149,7 +154,7 @@ static int panthor_alloc_heap_chunk(struct panthor_heap_pool *pool,
 	if (!chunk)
 		return -ENOMEM;
 
-	chunk->bo = panthor_kernel_bo_create(pool->ptdev, pool->vm, heap->chunk_size,
+	chunk->bo = panthor_kernel_bo_create(pool->ptdev, vm, heap->chunk_size,
 					     DRM_PANTHOR_BO_NO_MMAP,
 					     DRM_PANTHOR_VM_BIND_OP_MAP_NOEXEC,
 					     PANTHOR_VM_KERNEL_AUTO_VA,
@@ -209,6 +214,7 @@ static void panthor_free_heap_chunks(struct panthor_heap_pool *pool,
 }
 
 static int panthor_alloc_heap_chunks(struct panthor_heap_pool *pool,
+				     struct panthor_vm *vm,
 				     struct panthor_heap *heap,
 				     u32 chunk_count)
 {
@@ -216,7 +222,7 @@ static int panthor_alloc_heap_chunks(struct panthor_heap_pool *pool,
 	u32 i;
 
 	for (i = 0; i < chunk_count; i++) {
-		ret = panthor_alloc_heap_chunk(pool, heap, true);
+		ret = panthor_alloc_heap_chunk(pool, vm, heap, true);
 		if (ret)
 			return ret;
 	}
@@ -315,7 +321,7 @@ int panthor_heap_create(struct panthor_heap_pool *pool,
 	heap->max_chunks = max_chunks;
 	heap->target_in_flight = target_in_flight;
 
-	ret = panthor_alloc_heap_chunks(pool, heap, initial_chunk_count);
+	ret = panthor_alloc_heap_chunks(pool, vm, heap, initial_chunk_count);
 	if (ret)
 		goto err_free_heap;
 
@@ -473,7 +479,7 @@ int panthor_heap_grow(struct panthor_heap_pool *pool,
 	 * further jobs in this queue fail immediately instead of having to
 	 * wait for the job timeout.
 	 */
-	ret = panthor_alloc_heap_chunk(pool, heap, false);
+	ret = panthor_alloc_heap_chunk(pool, pool->vm, heap, false);
 	if (ret)
 		goto out_unlock;
 

base-commit: bafda823590ddf7031ecb765d673572fae7ab44a
-- 
2.43.0