Re: [PATCH] drm/virtio: fix vbuf->objs double-free, fence NULL deref, and sgt error path

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] drm/virtio: double-free of vbuf->objs in virtio_gpu_reclaim_vbufs
--

commit 94995582490827616358d8c115ec5215d43b829f
Author: Hui Peng <benquike@gmail.com>
Subject: drm/virtio: fix vbuf->objs double-free, fence NULL deref, and sgt error path

This patch modifies virtio_gpu_dequeue_ctrl_func() and free_vbuf() to
consolidate vbuf->objs cleanup inside free_vbuf(). It also handles fence
cancellation and checks for exbuf->size in submit initialization.

> diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
> --- a/drivers/gpu/drm/virtio/virtgpu_vq.c
> +++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
> @@ -202,6 +202,10 @@ static void *virtio_gpu_alloc_cmd_cb(struct virtio_gpu_device *vgdev,
>  static void free_vbuf(struct virtio_gpu_device *vgdev,
>  		      struct virtio_gpu_vbuffer *vbuf)
>  {
> +	if (vbuf->objs) {
> +		virtio_gpu_array_put_free_delayed(vgdev, vbuf->objs);
> +		vbuf->objs = NULL;
> +	}

[Severity: High]
Does this change introduce a double-free when called from
virtio_gpu_reclaim_vbufs()?

Looking at virtio_gpu_reclaim_vbufs() in the same file, the loop manually
frees the objects but does not clear the pointer before calling the newly
updated free_vbuf():

	while ((vbuf = virtqueue_detach_unused_buf(vgdev->ctrlq.vq))) {
		if (vbuf->objs)
			virtio_gpu_array_put_free(vbuf->objs);
		if (vbuf->resp_cb_data)
			virtio_gpu_cleanup_object(vbuf->resp_cb_data);
		free_vbuf(vgdev, vbuf);
	}

Since free_vbuf() now also attempts to free vbuf->objs via
virtio_gpu_array_put_free_delayed(), and the pointer is not cleared in
virtio_gpu_reclaim_vbufs(), won't this trigger a double-free on device
teardown when there are unused control queue buffers with attached objects?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260919223440.3884176-1-benquike@gmail.com?part=1