Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] drm/virtio: double-free of vbuf->objs in virtio_gpu_reclaim_vbufs --
commit 94995582490827616358d8c115ec5215d43b829f Author: Hui Peng <[email protected]> Subject: drm/virtio: fix vbuf->objs double-free, fence NULL deref, and sgt error path This patch modifies virtio_gpu_dequeue_ctrl_func() and free_vbuf() to consolidate vbuf->objs cleanup inside free_vbuf(). It also handles fence cancellation and checks for exbuf->size in submit initialization. > diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c > b/drivers/gpu/drm/virtio/virtgpu_vq.c > --- a/drivers/gpu/drm/virtio/virtgpu_vq.c > +++ b/drivers/gpu/drm/virtio/virtgpu_vq.c > @@ -202,6 +202,10 @@ static void *virtio_gpu_alloc_cmd_cb(struct > virtio_gpu_device *vgdev, > static void free_vbuf(struct virtio_gpu_device *vgdev, > struct virtio_gpu_vbuffer *vbuf) > { > + if (vbuf->objs) { > + virtio_gpu_array_put_free_delayed(vgdev, vbuf->objs); > + vbuf->objs = NULL; > + } [Severity: High] Does this change introduce a double-free when called from virtio_gpu_reclaim_vbufs()? Looking at virtio_gpu_reclaim_vbufs() in the same file, the loop manually frees the objects but does not clear the pointer before calling the newly updated free_vbuf(): while ((vbuf = virtqueue_detach_unused_buf(vgdev->ctrlq.vq))) { if (vbuf->objs) virtio_gpu_array_put_free(vbuf->objs); if (vbuf->resp_cb_data) virtio_gpu_cleanup_object(vbuf->resp_cb_data); free_vbuf(vgdev, vbuf); } Since free_vbuf() now also attempts to free vbuf->objs via virtio_gpu_array_put_free_delayed(), and the pointer is not cleared in virtio_gpu_reclaim_vbufs(), won't this trigger a double-free on device teardown when there are unused control queue buffers with attached objects? -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
