All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH v2] drm/ttm: fix NULL deref in ttm_bo_flush_all_fences() after fence ops detach
@ 2026-03-03 12:26 Sebastian Brzezinka
  2026-03-03 13:48 ` Christian König
                   ` (3 more replies)
  0 siblings, 4 replies; 8+ messages in thread
From: Sebastian Brzezinka @ 2026-03-03 12:26 UTC (permalink / raw)
  To: intel-gfx; +Cc: Sebastian Brzezinka, andi.shyti, Christian König

Since commit 541c8f2468b9 ("dma-buf: detach fence ops on signal v3"),
fence->ops may be set to NULL via RCU when a fence signals and has no
release/wait ops. ttm_bo_flush_all_fences() was not updated to handle
this and directly dereferences fence->ops->signaled, leading to a NULL
pointer dereference crash:

```
BUG: kernel NULL pointer dereference, address: 0000000000000018
RIP: 0010:ttm_bo_release+0x1bc/0x330 [ttm]
```

Since dma_fence_enable_sw_signaling() already handles the signaled case
internally (it checks DMA_FENCE_FLAG_SIGNALED_BIT before doing anything),
the ops->signaled pre-check is redundant. Simply remove it and call
dma_fence_enable_sw_signaling() unconditionally for each fence.

Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15759
Fixes: 541c8f2468b9 ("dma-buf: detach fence ops on signal v3")
Cc: Christian König <christian.koenig@amd.com>
Signed-off-by: Sebastian Brzezinka <sebastian.brzezinka@intel.com>
---
 drivers/gpu/drm/ttm/ttm_bo.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index acb9197db879..0485ad00a3df 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -222,10 +222,8 @@ static void ttm_bo_flush_all_fences(struct ttm_buffer_object *bo)
 	struct dma_fence *fence;
 
 	dma_resv_iter_begin(&cursor, resv, DMA_RESV_USAGE_BOOKKEEP);
-	dma_resv_for_each_fence_unlocked(&cursor, fence) {
-		if (!fence->ops->signaled)
-			dma_fence_enable_sw_signaling(fence);
-	}
+	dma_resv_for_each_fence_unlocked(&cursor, fence)
+		dma_fence_enable_sw_signaling(fence);
 	dma_resv_iter_end(&cursor);
 }
 
-- 
2.52.0


^ permalink raw reply related	[flat|nested] 8+ messages in thread

end of thread, other threads:[~2026-03-05  7:56 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-03-03 12:26 [PATCH v2] drm/ttm: fix NULL deref in ttm_bo_flush_all_fences() after fence ops detach Sebastian Brzezinka
2026-03-03 13:48 ` Christian König
2026-03-04 16:28   ` Jani Nikula
2026-03-04 16:37     ` Sebastian Brzezinka
2026-03-05  7:56       ` Christian König
2026-03-03 14:27 ` ✓ i915.CI.BAT: success for drm/ttm: fix NULL deref in ttm_bo_flush_all_fences() after fence ops detach (rev2) Patchwork
2026-03-03 22:47 ` ✗ i915.CI.Full: failure " Patchwork
2026-03-04 14:52 ` [PATCH v2] drm/ttm: fix NULL deref in ttm_bo_flush_all_fences() after fence ops detach Andi Shyti

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.