From mboxrd@z Thu Jan 1 00:00:00 1970 From: Claude Code Review Bot To: dri-devel-reviews@example.com Subject: Claude review: drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx Date: Sun, 12 Apr 2026 08:59:46 +1000 Message-ID: In-Reply-To: <20260411-adreno-fix-ubwc-v3-1-4983156f3f80@oss.qualcomm.com> References: <20260411-adreno-fix-ubwc-v3-1-4983156f3f80@oss.qualcomm.com> <20260411-adreno-fix-ubwc-v3-1-4983156f3f80@oss.qualcomm.com> X-Mailer: Claude Code Patch Reviewer Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Patch Review **Problem analysis:** Confirmed correct. The kernel source tree shows: - `a5xx_gpu.c` sets `adreno_gpu->ubwc_config =3D &adreno_gpu->_ubwc_config`= (line 1778) - `a6xx_gpu.c` sets `gpu->ubwc_config =3D &gpu->_ubwc_config` (line 807) - `a2xx_gpu.c`, `a3xx_gpu.c`, `a4xx_gpu.c` never touch `ubwc_config` =E2=80= =94 the pointer remains NULL from `kzalloc` Since `MSM_PARAM_HIGHEST_BANK_BIT` (0x10), `MSM_PARAM_UBWC_SWIZZLE` (0x12),= and `MSM_PARAM_MACROTILE_MODE` (0x13) are all UAPI params, any userspace p= rogram can query them and trigger the NULL dereference on pre-a5xx hardware. **Code review:** The three guard clauses are identical in structure and correct: ```c case MSM_PARAM_HIGHEST_BANK_BIT: if (!adreno_gpu->ubwc_config) return UERR(ENOENT, drm, "no UBWC on this platform"); *value =3D adreno_gpu->ubwc_config->highest_bank_bit; return 0; ``` - The `UERR(ENOENT, ...)` macro expands to `DRM_DEV_DEBUG_DRIVER(...)` foll= owed by returning `-ENOENT`. This is appropriate =E2=80=94 `ENOENT` signals= "this parameter doesn't exist on this hardware" which is semantically corr= ect and matches the review feedback. - The debug message is helpful for userspace developers without being noisy= (it's `DEBUG_DRIVER` level, not a warning). - All three UBWC-related params are covered: `HIGHEST_BANK_BIT`, `UBWC_SWIZ= ZLE`, and `MACROTILE_MODE`. No UBWC-related params are missed. **No issues found.** The patch is minimal, correct, has proper `Fixes:` tag= , and addresses the review feedback from v1/v2.=20 Reviewed-by worthy. --- Generated by Claude Code Patch Reviewer