From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 349E93B3C1D; Mon, 23 Mar 2026 14:12:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774275131; cv=none; b=YvraUatQIR7NAt4FL/t2dochibTBIC1yXkeI8tWPGryDpZiB5GSh0ZIlpVM+Ffx8P+1ZFijqC2ByDPSEwQrCnozSgI5v/4p2UhRMgZ9lcr0QOYbnG651y1SYFyvsNihUqtkqbrkUx/WeQgMSU0Dh0PTtaAOW1NQIw2seyZXS8u4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774275131; c=relaxed/simple; bh=mjKNq9PQsTvnue2EInif8V0o7DOSwz+WBetTFQvl4hc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=kxBWH8z/KoZI5enH6pER6Ip/ABt3Hn7+fjXKtvWrFauS079YTzvlRkLFUyHIUEFFGJRWTYzbhceM3Jt0j0M0ormqQRfWmrDV4buj5w4P8HvScW/vEZAB2kqMIs5CcjAloX4xd00DPeifs1wJBIGKwSOmsYTqz+vDqVmYRbxia/o= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=1JZMinWU; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="1JZMinWU" Received: by smtp.kernel.org (Postfix) with ESMTPSA id ADB37C4CEF7; Mon, 23 Mar 2026 14:12:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1774275131; bh=mjKNq9PQsTvnue2EInif8V0o7DOSwz+WBetTFQvl4hc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1JZMinWU09Hq6+RCNRlJ2iracvlKliIaecKfZfqF0dc0rKX233ylEFDL3JELGc1Cy TdkcNmM/wTMmLq1Lm8aUWPX/ttuUC1KW9PfSsmdgGRw8rteh9WB0NLUli3Aq1TDdC3 12X8GB1+HlFQ/eP1EGECDkJfOT/siFHN3fVzwUX0= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Kuzey Arda Bulut , Ian Forbes , Zack Rusin , Sasha Levin Subject: [PATCH 6.6 002/567] drm/vmwgfx: Return the correct value in vmw_translate_ptr functions Date: Mon, 23 Mar 2026 14:38:42 +0100 Message-ID: <20260323134533.810161956@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260323134533.749096647@linuxfoundation.org> References: <20260323134533.749096647@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ian Forbes [ Upstream commit 5023ca80f9589295cb60735016e39fc5cc714243 ] Before the referenced fixes these functions used a lookup function that returned a pointer. This was changed to another lookup function that returned an error code with the pointer becoming an out parameter. The error path when the lookup failed was not changed to reflect this change and the code continued to return the PTR_ERR of the now uninitialized pointer. This could cause the vmw_translate_ptr functions to return success when they actually failed causing further uninitialized and OOB accesses. Reported-by: Kuzey Arda Bulut Fixes: a309c7194e8a ("drm/vmwgfx: Remove rcu locks from user resources") Signed-off-by: Ian Forbes Reviewed-by: Zack Rusin Signed-off-by: Zack Rusin Link: https://patch.msgid.link/20260113175357.129285-1-ian.forbes@broadcom.com Signed-off-by: Sasha Levin --- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c index 92b3e44d022fe..073791d696295 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c @@ -1160,7 +1160,7 @@ static int vmw_translate_mob_ptr(struct vmw_private *dev_priv, ret = vmw_user_bo_lookup(sw_context->filp, handle, &vmw_bo); if (ret != 0) { drm_dbg(&dev_priv->drm, "Could not find or use MOB buffer.\n"); - return PTR_ERR(vmw_bo); + return ret; } vmw_bo_placement_set(vmw_bo, VMW_BO_DOMAIN_MOB, VMW_BO_DOMAIN_MOB); ret = vmw_validation_add_bo(sw_context->ctx, vmw_bo); @@ -1216,7 +1216,7 @@ static int vmw_translate_guest_ptr(struct vmw_private *dev_priv, ret = vmw_user_bo_lookup(sw_context->filp, handle, &vmw_bo); if (ret != 0) { drm_dbg(&dev_priv->drm, "Could not find or use GMR region.\n"); - return PTR_ERR(vmw_bo); + return ret; } vmw_bo_placement_set(vmw_bo, VMW_BO_DOMAIN_GMR | VMW_BO_DOMAIN_VRAM, VMW_BO_DOMAIN_GMR | VMW_BO_DOMAIN_VRAM); -- 2.51.0