On 4/14/26 12:55, popov.nkv@gmail.com wrote:

From: Vladimir Popov popov.nkv@gmail.com

If vmw_execbuf_fence_commands() call fails in vmw_kms_helper_validation_finish(), it sets *p_fence = NULL. If ctx->bo_list is not empty, the caller, vmw_kms_helper_validation_finish(), passes the fence through a chain of functions to dma_fence_is_array(), which causes a NULL pointer dereference in dma_fence_is_array():

vmw_kms_helper_validation_finish() // pass NULL fence vmw_validation_done() vmw_validation_bo_fence() ttm_eu_fence_buffer_objects() // pass NULL fence dma_resv_add_fence() dma_fence_is_container() dma_fence_is_array() // NULL deref

Well good catch, but that is clearly not the right fix.

I'm not an expert for the vmwgfx code but in case of an error vmw_validation_revert() should be called an not vmw_kms_helper_validation_finish().

Regards, Christian.

Fix this by adding a NULL check in vmw_validation_bo_fence(): if the fence is NULL, fall back to ttm_eu_backoff_reservation()to safely release the buffer object reservations without attempting to add a NULL fence to dma_resv. This is safe because when fence is NULL, vmw_fallback_wait() has already been called inside vmw_execbuf_fence_commands() to synchronize the GPU.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 038ecc503236 ("drm/vmwgfx: Add a validation module v2") Cc: stable@vger.kernel.org Signed-off-by: Vladimir Popov popov.nkv@gmail.com

---

drivers/gpu/drm/vmwgfx/vmwgfx_validation.h | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.h b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.h index 353d837907d8..fc04555ca505 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.h +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.h @@ -127,16 +127,23 @@ vmw_validation_bo_reserve(struct vmw_validation_context *ctx,

• vmw_validation_bo_fence - Unreserve and fence buffer objects registered
• with a validation context
• @ctx: The validation context

• • @fence: Fence with which to fence all buffer objects taking part in the
• • command submission.
  • This function unreserves the buffer objects previously reserved using

• • vmw_validation_bo_reserve, and fences them with a fence object.

• • vmw_validation_bo_reserve, and fences them with a fence object if the
• • given fence object is not NULL.
  */

static inline void vmw_validation_bo_fence(struct vmw_validation_context *ctx, struct vmw_fence_obj *fence) {

•   ttm_eu_fence_buffer_objects(&ctx->ticket, &ctx->bo_list,
  

•                               (void *) fence);
  

•   /* fence is able to be NULL if vmw_execbuf_fence_commands() fails */
  

•   if (fence)
  

•           ttm_eu_fence_buffer_objects(&ctx->ticket, &ctx->bo_list,
  

•                                       (void *)fence);
  

•   else
  

•           ttm_eu_backoff_reservation(&ctx->ticket, &ctx->bo_list);
  

}

/**

2.43.0