Re: [PATCH] drm/vmwgfx: release imported dma-buf when the BO is freed

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] drm/vmwgfx: null pointer dereference and double-free in DMA unmap on prime import teardown
--

commit 5e0534afee105a8ad6c4fdcc95d44acdb11a1c6c
Author: Adam Lewis <adam.j.lewis@gmail.com>

drm/vmwgfx: release imported dma-buf when the BO is freed

vmw_prime_import_sg_table() creates a BO for a foreign dma-buf through
drm_gem_prime_import_dev(), which attaches to the dma-buf, maps the
attachment and takes a reference on it.  vmw_bo_free() never undoes
this, so each foreign import leaks the attachment, its sg table and the
dma-buf reference.

> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c
> index 9c7a73c0b0dc3..f226b32312387 100644
> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c
> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c
[ ... ]
> @@ -69,6 +70,8 @@ static void vmw_bo_free(struct ttm_buffer_object *bo)
>  		vmw_surface_unreference(&vbo->dumb_surface);
>  	}
>  	WARN_ON(!RB_EMPTY_ROOT(&vbo->res_tree));
> +	if (drm_gem_is_imported(&vbo->tbo.base))
> +		drm_prime_gem_destroy(&vbo->tbo.base, vbo->tbo.sg);

[Severity: High]
Does this trigger a null pointer dereference and double-free during DMA unmap?

For imported dma-bufs, ttm_bo_release() first calls
ttm_bo_cleanup_memtype_use(), which calls vmw_ttm_unmap_dma():

drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c:vmw_ttm_unmap_dma() {
    ...
	case vmw_dma_map_bind:
	case vmw_dma_map_populate:
		vmw_ttm_unmap_from_dma(vmw_tt);
		sg_free_table(vmw_tt->vsgt.sgt);
		vmw_tt->vsgt.sgt = NULL;
		break;
    ...
}

This frees the exporter's sg_table arrays using sg_free_table(), setting
sgt->sgl to NULL but leaving sgt->nents intact.

Later, vmw_bo_free() calls drm_prime_gem_destroy(), prompting the exporter
to call dma_unmap_sgtable(). The unmap function passes sgt->sgl (which is now
NULL) to dma_unmap_sg_attrs(), resulting in a guaranteed null pointer
dereference when iterating over the scatterlist.

>  	drm_gem_object_release(&vbo->tbo.base);
>  	WARN_ON(vbo->dirty);
>  	kfree(vbo);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260929205928.230301-1-adam.j.lewis@gmail.com?part=1