Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] drm/vmwgfx: null pointer dereference and double-free in DMA unmap on prime import teardown --
commit 5e0534afee105a8ad6c4fdcc95d44acdb11a1c6c Author: Adam Lewis <[email protected]> drm/vmwgfx: release imported dma-buf when the BO is freed vmw_prime_import_sg_table() creates a BO for a foreign dma-buf through drm_gem_prime_import_dev(), which attaches to the dma-buf, maps the attachment and takes a reference on it. vmw_bo_free() never undoes this, so each foreign import leaks the attachment, its sg table and the dma-buf reference. > diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c > b/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c > index 9c7a73c0b0dc3..f226b32312387 100644 > --- a/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c > +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c [ ... ] > @@ -69,6 +70,8 @@ static void vmw_bo_free(struct ttm_buffer_object *bo) > vmw_surface_unreference(&vbo->dumb_surface); > } > WARN_ON(!RB_EMPTY_ROOT(&vbo->res_tree)); > + if (drm_gem_is_imported(&vbo->tbo.base)) > + drm_prime_gem_destroy(&vbo->tbo.base, vbo->tbo.sg); [Severity: High] Does this trigger a null pointer dereference and double-free during DMA unmap? For imported dma-bufs, ttm_bo_release() first calls ttm_bo_cleanup_memtype_use(), which calls vmw_ttm_unmap_dma(): drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c:vmw_ttm_unmap_dma() { ... case vmw_dma_map_bind: case vmw_dma_map_populate: vmw_ttm_unmap_from_dma(vmw_tt); sg_free_table(vmw_tt->vsgt.sgt); vmw_tt->vsgt.sgt = NULL; break; ... } This frees the exporter's sg_table arrays using sg_free_table(), setting sgt->sgl to NULL but leaving sgt->nents intact. Later, vmw_bo_free() calls drm_prime_gem_destroy(), prompting the exporter to call dma_unmap_sgtable(). The unmap function passes sgt->sgl (which is now NULL) to dma_unmap_sg_attrs(), resulting in a guaranteed null pointer dereference when iterating over the scatterlist. > drm_gem_object_release(&vbo->tbo.base); > WARN_ON(vbo->dirty); > kfree(vbo); -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
