NULL FIFO state reached by context creation

NULL FIFO state reached by context creation

[潘煜杭]

Hello,

GPT-6-Luna assisted with the initial analysis and drafting the proposed fix.
I am responsible for this report.

I found a NULL-pointer dereference in the vmwgfx context creation path in the
Linux 7.1.5 setup. In this run, the emulated PCI function did not
provide a usable FIFO: dev_priv->fifo was NULL, and the command-buffer manager
was unavailable. The ioctl nevertheless reached the local FIFO reservation
path and dereferenced fifo_state->capabilities.

The relevant log excerpt is:

  BUG: kernel NULL pointer dereference, address: 0000000000000024
  #PF: supervisor read access in kernel mode
  RIP: vmw_cmd_ctx_reserve+0x102/0x600
  Code: ... <41> 8b 47 24 ...
  R15: 0000000000000000
  CR2: 0000000000000024
  Call Trace:
    vmw_context_init
    vmw_context_define.isra.0+0x1b5/0x6d0
    vmw_context_define_ioctl+0x36/0x40
    drm_ioctl_kernel
    drm_ioctl
    vmw_generic_ioctl
    vmw_unlocked_ioctl
    __x64_sys_ioctl

The instruction reads `[R15 + 0x24]`. R15 is zero and the fault address is
0x24, consistent with reading the capabilities field through a NULL
vmw_fifo_state pointer.

The source-level path is:

  __x64_sys_ioctl
    -> vmw_unlocked_ioctl()
    -> vmw_generic_ioctl()
    -> drm_ioctl()
    -> vmw_context_define_ioctl()
    -> vmw_context_define()
    -> vmw_context_init()
    -> VMW_CMD_RESERVE()
    -> vmw_cmd_ctx_reserve()
    -> vmw_local_fifo_reserve()
    -> fifo_state->capabilities
    -> NULL dereference

The ioctl requests a context; it does not initialize the FIFO. vmw_context_define()
allocates the software context and calls vmw_context_init(), which emits the
device context-definition command. That command uses VMW_CMD_RESERVE(). In this
run `dev_priv->cman` is absent, so vmw_cmd_ctx_reserve() takes its legacy
local-FIFO branch for the invalid context id. vmw_local_fifo_reserve()
initializes `fifo_state` from `dev_priv->fifo` and immediately reads
`fifo_state->capabilities` to decide whether in-place reservation is supported.
Because this emulated device instance has no usable FIFO state
(`dev_priv->fifo == NULL`), the first field read is through NULL + 0x24,
matching CR2 and the faulting instruction. Thus the ioctl reaches the code;
missing FIFO/command-buffer state is the precondition; and the unguarded field
read is the crash. The report proves the state was absent at use time, but
does not by itself establish why probe left this emulated function without it.

The user-visible trigger is opening the DRM device and issuing
DRM_IOCTL_VMW_CREATE_CONTEXT. A tested syzkaller reproducer is available and
can be provided privately to the maintainers on request; it is not included
in this public report.

The patch below makes vmw_local_fifo_reserve() return an error if the
local FIFO state or FIFO memory is absent. It also validates FIFO offsets
before using them. This crash was observed with the QEMU configuration, I have
not established that a supported VMware device can reach the same state.
The patch passes `git apply --check`, but has not yet had runtime regression
testing.

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cmd.c b/drivers/gpu/drm/vmwgfx/vmwgfx_cmd.c
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_cmd.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cmd.c
@@ -302,9 +302,12 @@ static void *vmw_local_fifo_reserve(struct vmw_private *dev_priv,
  uint32_t max;
  uint32_t min;
  uint32_t next_cmd;
- uint32_t reserveable = fifo_state->capabilities & SVGA_FIFO_CAP_RESERVE;
+ uint32_t reserveable;
  int ret;
 
+ if (unlikely(!fifo_state || !fifo_mem))
+   return NULL;
+ reserveable = fifo_state->capabilities & SVGA_FIFO_CAP_RESERVE;
  mutex_lock(&fifo_state->fifo_mutex);
  max = vmw_fifo_mem_read(dev_priv, SVGA_FIFO_MAX);
  min = vmw_fifo_mem_read(dev_priv, SVGA_FIFO_MIN);
@@ -311,4 +315,6 @@ static void *vmw_local_fifo_reserve(struct vmw_private *dev_priv,
  next_cmd = vmw_fifo_mem_read(dev_priv, SVGA_FIFO_NEXT_CMD);
 
- if (unlikely(bytes >= (max - min)))
+ if (unlikely(min >= max || next_cmd < min || next_cmd >= max ||
+        ((min | max | next_cmd) & 3) ||
+        bytes >= (max - min)))
    goto out_err;
@@ -321,6 +327,9 @@ static void *vmw_local_fifo_reserve(struct vmw_private *dev_priv,
  while (1) {
    uint32_t stop = vmw_fifo_mem_read(dev_priv, SVGA_FIFO_STOP);
    bool need_bounce = false;
    bool reserve_in_place = false;
+
+   if (unlikely(stop < min || stop >= max || (stop & 3)))
+     goto out_err;
 
    if (next_cmd >= stop) {

Regards,
Yuhang Pan
242270054@hdu.edu.cn

Re: NULL FIFO state reached by context creation

[Greg KH]

On Wed, Oct 28, 2026 at 05:35:20PM +0800, 潘煜杭 wrote:
> 
> 
> 
> Hello,
> 
> GPT-6-Luna assisted with the initial analysis and drafting the proposed fix.
> I am responsible for this report.

Again, please turn this into a real patch that can be applied.

thanks,

greg k-h