Re: [PATCH 15901/15901] drm/vmwgfx: fix NULL pointer dereference in vmw_validation_bo_fence()

["Christian König" <christian.koenig@amd.com>]

On 4/14/26 12:55, popov.nkv@gmail.com wrote:
> From: Vladimir Popov <popov.nkv@gmail.com>
> 
> If vmw_execbuf_fence_commands() call fails in
> vmw_kms_helper_validation_finish(), it sets *p_fence = NULL. If
> ctx->bo_list is not empty, the caller, vmw_kms_helper_validation_finish(),
> passes the fence through a chain of functions to dma_fence_is_array(),
> which causes a NULL pointer dereference in dma_fence_is_array():
> 
> vmw_kms_helper_validation_finish() // pass NULL fence
>   vmw_validation_done()
>     vmw_validation_bo_fence()
>       ttm_eu_fence_buffer_objects() // pass NULL fence
>         dma_resv_add_fence()
>           dma_fence_is_container()
>             dma_fence_is_array() // NULL deref

Well good catch, but that is clearly not the right fix.

I'm not an expert for the vmwgfx code but in case of an error vmw_validation_revert() should be called an not vmw_kms_helper_validation_finish().

Regards,
Christian.

> 
> Fix this by adding a NULL check in vmw_validation_bo_fence(): if the fence
> is NULL, fall back to ttm_eu_backoff_reservation()to safely release
> the buffer object reservations without attempting to add a NULL fence to
> dma_resv. This is safe because when fence is NULL, vmw_fallback_wait()
> has already been called inside vmw_execbuf_fence_commands() to synchronize
> the GPU.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: 038ecc503236 ("drm/vmwgfx: Add a validation module v2")
> Cc: stable@vger.kernel.org
> Signed-off-by: Vladimir Popov <popov.nkv@gmail.com>
> ---
>  drivers/gpu/drm/vmwgfx/vmwgfx_validation.h | 13 ++++++++++---
>  1 file changed, 10 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.h b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.h
> index 353d837907d8..fc04555ca505 100644
> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.h
> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.h
> @@ -127,16 +127,23 @@ vmw_validation_bo_reserve(struct vmw_validation_context *ctx,
>   * vmw_validation_bo_fence - Unreserve and fence buffer objects registered
>   * with a validation context
>   * @ctx: The validation context
> + * @fence: Fence with which to fence all buffer objects taking part in the
> + * command submission.
>   *
>   * This function unreserves the buffer objects previously reserved using
> - * vmw_validation_bo_reserve, and fences them with a fence object.
> + * vmw_validation_bo_reserve, and fences them with a fence object if the
> + * given fence object is not NULL.
>   */
>  static inline void
>  vmw_validation_bo_fence(struct vmw_validation_context *ctx,
>                         struct vmw_fence_obj *fence)
>  {
> -       ttm_eu_fence_buffer_objects(&ctx->ticket, &ctx->bo_list,
> -                                   (void *) fence);
> +       /* fence is able to be NULL if vmw_execbuf_fence_commands() fails */
> +       if (fence)
> +               ttm_eu_fence_buffer_objects(&ctx->ticket, &ctx->bo_list,
> +                                           (void *)fence);
> +       else
> +               ttm_eu_backoff_reservation(&ctx->ticket, &ctx->bo_list);
>  }
> 
>  /**
> --
> 2.43.0
>