[PATCH] drm/vmwgfx: Fix NULL vs error pointer bug in vmw_prime_import_sg_table()

[PATCH] drm/vmwgfx: Fix NULL vs error pointer bug in vmw_prime_import_sg_table()

[Dan Carpenter]

The vmw_prime_import_sg_table() function is expected to return error
pointers on error and not NULL.  Otherwise it leads to a NULL dereference
in the caller drm_gem_prime_import_dev().

Change the NULL to ERR_PTR(-ENOMEM).

Fixes: b32233acceff ("drm/vmwgfx: Fix prime import/export")
Signed-off-by: Dan Carpenter <error27@gmail.com>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_gem.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c b/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c
index 39f8c46550c2..f25db04f8777 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c
@@ -184,7 +184,7 @@ struct drm_gem_object *vmw_prime_import_sg_table(struct drm_device *dev,
 {
 	int ret;
 	struct vmw_private *dev_priv = vmw_priv(dev);
-	struct drm_gem_object *gem = NULL;
+	struct drm_gem_object *gem = ERR_PTR(-ENOMEM);
 	struct vmw_bo *vbo;
 	struct vmw_bo_params params = {
 		.domain = (dev_priv->has_mob) ? VMW_BO_DOMAIN_SYS : VMW_BO_DOMAIN_VRAM,
-- 
2.53.0

Re: [PATCH] drm/vmwgfx: Fix NULL vs error pointer bug in vmw_prime_import_sg_table()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The error path unconditionally returns ERR_PTR(-ENOMEM), masking the actual error code from vmw_bo_create().
--

commit 97833dd848667c1ef6ccc7587272c584beab9fb5
Author: Dan Carpenter <error27@gmail.com>

drm/vmwgfx: Fix NULL vs error pointer bug in vmw_prime_import_sg_table()

The patch changes the initial value of gem in vmw_prime_import_sg_table()
from NULL to ERR_PTR(-ENOMEM) to prevent a NULL pointer dereference in the
caller when vmw_bo_create() fails.

> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c b/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c
> index 39f8c46550c27..f25db04f87778 100644
> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c
> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c
> @@ -184,7 +184,7 @@ struct drm_gem_object *vmw_prime_import_sg_table(struct drm_device *dev,
>  {
>  	int ret;
>  	struct vmw_private *dev_priv = vmw_priv(dev);
> -	struct drm_gem_object *gem = NULL;
> +	struct drm_gem_object *gem = ERR_PTR(-ENOMEM);

[Severity: High]
This is a pre-existing issue, but does hardcoding ERR_PTR(-ENOMEM) mask the
actual error returned by vmw_bo_create()?

When vmw_bo_create() fails, it returns an error code in the ret variable:

	ret = vmw_bo_create(dev_priv, &params, &vbo);
	if (ret != 0)
		goto out_no_bo;

Since gem is initialized to ERR_PTR(-ENOMEM) and never updated with ret before
jumping to out_no_bo, the actual error code is permanently lost.

If vmw_bo_create() is interrupted by a signal and returns -ERESTARTSYS,
masking it with -ENOMEM breaks the kernel's signal handling and syscall
restart mechanism. This could potentially cause unexpected failures in
userspace applications and compositors.

Could gem be updated to ERR_PTR(ret) in the error path instead?

>  	struct vmw_bo *vbo;
>  	struct vmw_bo_params params = {
>  		.domain = (dev_priv->has_mob) ? VMW_BO_DOMAIN_SYS : VMW_BO_DOMAIN_VRAM,

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/akIR3WlKLCiCTb5T@stanley.mountain?part=1

Re: [PATCH] drm/vmwgfx: Fix NULL vs error pointer bug in vmw_prime_import_sg_table()

[Dan Carpenter]

On Mon, Jun 29, 2026 at 06:43:12AM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> 
> Pre-existing issues:
> - [High] The error path unconditionally returns ERR_PTR(-ENOMEM), masking the actual error code from vmw_bo_create().
> --

Fair enough.  It's better to propagate the error code.

regards,
dan carpenter

Re: [PATCH] drm/vmwgfx: Fix NULL vs error pointer bug in vmw_prime_import_sg_table()

[Maaz Mombasawala]

On 6/28/26 11:34 PM, Dan Carpenter wrote:
> The vmw_prime_import_sg_table() function is expected to return error
> pointers on error and not NULL.  Otherwise it leads to a NULL dereference
> in the caller drm_gem_prime_import_dev().
> 
> Change the NULL to ERR_PTR(-ENOMEM).
> 
> Fixes: b32233acceff ("drm/vmwgfx: Fix prime import/export")
> Signed-off-by: Dan Carpenter <error27@gmail.com>
> ---
>  drivers/gpu/drm/vmwgfx/vmwgfx_gem.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c b/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c
> index 39f8c46550c2..f25db04f8777 100644
> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c
> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c
> @@ -184,7 +184,7 @@ struct drm_gem_object *vmw_prime_import_sg_table(struct drm_device *dev,
>  {
>  	int ret;
>  	struct vmw_private *dev_priv = vmw_priv(dev);
> -	struct drm_gem_object *gem = NULL;
> +	struct drm_gem_object *gem = ERR_PTR(-ENOMEM);
>  	struct vmw_bo *vbo;
>  	struct vmw_bo_params params = {
>  		.domain = (dev_priv->has_mob) ? VMW_BO_DOMAIN_SYS : VMW_BO_DOMAIN_VRAM,

LGTM!

Reviewed-by: Maaz Mombasawala <maaz.mombasawala@broadcom.com>

-- 
Maaz Mombasawala <maaz.mombasawala@broadcom.com>