This is a note to let you know that I've just added the patch titled
drm/vmwgfx: Set surface-framebuffer GEM objects
to the 6.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
drm-vmwgfx-set-surface-framebuffer-gem-objects.patch
and it can be found in the queue-6.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From 9942d36a73c2d46c52fdd6f37cf698f3cb09ce5c Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <[email protected]>
Date: Tue, 4 Nov 2025 11:36:04 +0100
Subject: drm/vmwgfx: Set surface-framebuffer GEM objects
From: Thomas Zimmermann <[email protected]>
commit 9942d36a73c2d46c52fdd6f37cf698f3cb09ce5c upstream.
Set struct drm_framebuffer.obj[0] to the allocated GEM buffer object
for surface framebuffers. Avoids a NULL-pointer deref in the client's
vmap helpers.
[ 22.640191] Console: switching to colour frame buffer device 160x50
[ 22.641788] Oops: general protection fault, probably for
non-canonical address 0xdffffc000000001f: 0000 [#1] SMP KASAN NOPTI
[ 22.641795] KASAN: null-ptr-deref in range
[0x00000000000000f8-0x00000000000000ff]
[...]
[ 22.641809] Hardware name: VMware, Inc. VMware20,1/440BX Desktop
Reference Platform, BIOS VMW201.00V.24928539.B64.2508260915 08/26/2025
[ 22.641812] Workqueue: events drm_fb_helper_damage_work
[ 22.641824] RIP: 0010:drm_gem_lock+0x25/0x50
[ 22.641831] Code: 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 48 b8
00 00 00 00 00 fc ff df 53 48 89 fb 48 81 c7 f8 00 00 00 48 89 fa 48
c1 ea 03 <80> 3c 02 00 75 0f 48 8b bb f8 00 00 00 31 f6 5b e9 16 2e 15
01 e8
[...]
[ 22.641889] Call Trace:
[ 22.641891] <TASK>
[ 22.641894] drm_client_buffer_vmap_local+0x78/0x140
[ 22.641903] drm_fbdev_ttm_helper_fb_dirty+0x20c/0x510 [drm_ttm_helper]
[ 22.641913] ? __pfx_drm_fbdev_ttm_helper_fb_dirty+0x10/0x10 [drm_ttm_helper]
[ 22.641918] ? __raw_spin_lock_irqsave+0x8c/0xf0
[ 22.641924] ? __pfx___raw_spin_lock_irqsave+0x10/0x10
[ 22.641928] ? __pfx_mutex_lock+0x10/0x10
[ 22.641936] drm_fb_helper_fb_dirty+0x29a/0x5e0
[ 22.641942] ? __pfx_drm_fb_helper_fb_dirty+0x10/0x10
[...]
Signed-off-by: Thomas Zimmermann <[email protected]>
Fixes: ea39f2e66e61 ("drm/client: Deprecate struct drm_client_buffer.gem")
Reported-by: Ian Forbes <[email protected]>
Closes:
https://lore.kernel.org/dri-devel/cao6mgtjg8pirislomjqrbdutbsc0wkqx67tezwa9qwogrzc...@mail.gmail.com/
Cc: Thomas Zimmermann <[email protected]>
Cc: Jocelyn Falempe <[email protected]>
Cc: Maarten Lankhorst <[email protected]>
Cc: Maxime Ripard <[email protected]>
Cc: David Airlie <[email protected]>
Cc: Simona Vetter <[email protected]>
Cc: [email protected]
Tested-by: Ian Forbes <[email protected]>
Reviewed-by: Jocelyn Falempe <[email protected]>
Reviewed-by: Zack Rusin <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -553,6 +553,9 @@ static int vmw_kms_new_framebuffer_surfa
memcpy(&vfbs->uo, uo, sizeof(vfbs->uo));
vmw_user_object_ref(&vfbs->uo);
+ if (vfbs->uo.buffer)
+ vfbs->base.base.obj[0] = &vfbs->uo.buffer->tbo.base;
+
*out = &vfbs->base;
ret = drm_framebuffer_init(dev, &vfbs->base.base,
Patches currently in stable-queue which might be from [email protected] are
queue-6.18/drm-client-remove-drm_client_framebuffer_delete.patch
queue-6.18/drm-client-remove-pitch-from-struct-drm_client_buffe.patch
queue-6.18/drm-client-move-dumb-buffer-handling-to-drm_client_f.patch
queue-6.18/drm-client-inline-drm_client_buffer_addfb-and-_rmfb.patch
queue-6.18/drm-connector-hdmi-fix-out-of-bounds-memory-read.patch
queue-6.18/drm-vmwgfx-set-surface-framebuffer-gem-objects.patch
queue-6.18/drm-client-deprecate-struct-drm_client_buffer.gem.patch
