Re: [PATCH] drm/gem-dma: fix double GEM object put on the mmap error path

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Double-put causing Use-After-Free and memory leak on mmap paths in exynos_drm_gem_mmap()
--

--- Patch [1]: [PATCH] drm/gem-dma: fix double GEM object put on the mmap error path ---
commit 381f3566395605c2a5479094f795c8569a814b8a
Author: Baul Lee <baul.lee@xbow.com>

drm/gem-dma: fix double GEM object put on the mmap error path

This commit removes drm_gem_vm_close() from the error path of
drm_gem_dma_mmap() to prevent a double-put of the GEM object. The caller
drm_gem_mmap_obj() already drops the reference on error, so the extra
put resulted in an underflow and use-after-free.

> exynos_drm_gem_mmap() and __tegra_gem_mmap() have the same error path.

[Severity: High]
This isn't a bug introduced by this patch, but since the commit message
mentions exynos_drm_gem_mmap() having the same error path, looking at that
function:

drivers/gpu/drm/exynos/exynos_drm_gem.c:exynos_drm_gem_mmap() {
    ...
	ret = exynos_drm_gem_mmap_buffer(exynos_gem, vma);
	if (ret)
		goto err_close_vm;

	return ret;

err_close_vm:
	drm_gem_vm_close(vma);

	return ret;
}

Can this cause a double-put leading to a use-after-free?

When returning an error, this explicitly calls drm_gem_vm_close(vma) which
drops a reference. The caller drm_gem_mmap_obj() will see the error and drop
the reference again, causing a double-put.

[Severity: High]
This is also a pre-existing issue, but looking at the import path earlier in
the same function:

drivers/gpu/drm/exynos/exynos_drm_gem.c:exynos_drm_gem_mmap() {
    ...
	if (obj->import_attach)
		return dma_buf_mmap(obj->dma_buf, vma, 0);
    ...
}

Does this code leak the GEM object?

On success, dma_buf_mmap() replaces vma->vm_ops and vma->vm_private_data
with the exporter's state without dropping the surplus reference acquired
by drm_gem_mmap_obj(). This could cause a memory leak when the VMA is
torn down.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260805124442.57426-1-baul.lee@xbow.com?part=1