[PATCH] drm/vmwgfx: Handle MOBs without page-table BOs

[PATCH] drm/vmwgfx: Handle MOBs without page-table BOs

[Ruoyu Wang]

Single-page MOBs and small OTable bases use depth-0 page-table entries
and do not allocate a page-table BO. Their existing teardown paths were
written to tolerate that by checking a local BO pointer before reserving
or fencing it.

Commit 668b206601c5 ("drm/vmwgfx: Stop using raw ttm_buffer_object's")
changed pt_bo from a raw TTM buffer object pointer to a vmwgfx BO pointer
and converted those local BO initializers to &pt_bo->tbo. That
dereferences pt_bo before the existing NULL checks, so depth-0 MOBs can
crash during OTable teardown or MOB unbind.

Keep the previous conditional behavior by deriving the TTM BO only when
the MOB has a page-table BO.

This issue was found by a static analysis checker and confirmed by
manual source review.

Fixes: 668b206601c5 ("drm/vmwgfx: Stop using raw ttm_buffer_object's")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_mob.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c b/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c
index de7a504de9ce5..7cfd96e6e3489 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c
@@ -204,7 +204,9 @@ static void vmw_takedown_otable_base(struct vmw_private *dev_priv,
 	if (otable->page_table == NULL)
 		return;
 
-	bo = &otable->page_table->pt_bo->tbo;
+	bo = NULL;
+	if (otable->page_table->pt_bo)
+		bo = &otable->page_table->pt_bo->tbo;
 	cmd = VMW_CMD_RESERVE(dev_priv, sizeof(*cmd));
 	if (unlikely(cmd == NULL))
 		return;
@@ -555,7 +557,10 @@ void vmw_mob_unbind(struct vmw_private *dev_priv,
 		SVGA3dCmdDestroyGBMob body;
 	} *cmd;
 	int ret;
-	struct ttm_buffer_object *bo = &mob->pt_bo->tbo;
+	struct ttm_buffer_object *bo = NULL;
+
+	if (mob->pt_bo)
+		bo = &mob->pt_bo->tbo;
 
 	if (bo) {
 		ret = ttm_bo_reserve(bo, false, true, NULL);
-- 
2.51.0

Re: [PATCH] drm/vmwgfx: Handle MOBs without page-table BOs

[Maaz Mombasawala]

On 7/7/26 8:05 AM, Ruoyu Wang wrote:
> Single-page MOBs and small OTable bases use depth-0 page-table entries
> and do not allocate a page-table BO. Their existing teardown paths were
> written to tolerate that by checking a local BO pointer before reserving
> or fencing it.
> 
> Commit 668b206601c5 ("drm/vmwgfx: Stop using raw ttm_buffer_object's")
> changed pt_bo from a raw TTM buffer object pointer to a vmwgfx BO pointer
> and converted those local BO initializers to &pt_bo->tbo. That
> dereferences pt_bo before the existing NULL checks, so depth-0 MOBs can
> crash during OTable teardown or MOB unbind.
> 
> Keep the previous conditional behavior by deriving the TTM BO only when
> the MOB has a page-table BO.
> 
> This issue was found by a static analysis checker and confirmed by
> manual source review.
> 
> Fixes: 668b206601c5 ("drm/vmwgfx: Stop using raw ttm_buffer_object's")
> Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
> ---
>  drivers/gpu/drm/vmwgfx/vmwgfx_mob.c | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c b/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c
> index de7a504de9ce5..7cfd96e6e3489 100644
> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c
> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_mob.c
> @@ -204,7 +204,9 @@ static void vmw_takedown_otable_base(struct vmw_private *dev_priv,
>  	if (otable->page_table == NULL)
>  		return;
>  
> -	bo = &otable->page_table->pt_bo->tbo;
> +	bo = NULL;

You can initialize bo as NULL, like in vmw_mob_unbind().

> +	if (otable->page_table->pt_bo)
> +		bo = &otable->page_table->pt_bo->tbo;
>  	cmd = VMW_CMD_RESERVE(dev_priv, sizeof(*cmd));
>  	if (unlikely(cmd == NULL))
>  		return;
> @@ -555,7 +557,10 @@ void vmw_mob_unbind(struct vmw_private *dev_priv,
>  		SVGA3dCmdDestroyGBMob body;
>  	} *cmd;
>  	int ret;
> -	struct ttm_buffer_object *bo = &mob->pt_bo->tbo;
> +	struct ttm_buffer_object *bo = NULL;
> +
> +	if (mob->pt_bo)
> +		bo = &mob->pt_bo->tbo;
>  
>  	if (bo) {
>  		ret = ttm_bo_reserve(bo, false, true, NULL);


-- 
Maaz Mombasawala <maaz.mombasawala@broadcom.com>

Re: [PATCH] drm/vmwgfx: Handle MOBs without page-table BOs

[Zack Rusin]

[-- Attachment #1: Type: text/plain, Size: 1185 bytes --]

On Tue, Jul 7, 2026 at 11:05 AM Ruoyu Wang <ruoyuw560@gmail.com> wrote:
>
> Single-page MOBs and small OTable bases use depth-0 page-table entries
> and do not allocate a page-table BO. Their existing teardown paths were
> written to tolerate that by checking a local BO pointer before reserving
> or fencing it.
>
> Commit 668b206601c5 ("drm/vmwgfx: Stop using raw ttm_buffer_object's")
> changed pt_bo from a raw TTM buffer object pointer to a vmwgfx BO pointer
> and converted those local BO initializers to &pt_bo->tbo. That
> dereferences pt_bo before the existing NULL checks, so depth-0 MOBs can
> crash during OTable teardown or MOB unbind.

That analysis is incorrect. Nothing here can crash. &pt_bo->tbo is not
a dereference. It's address-of-member. tbo is the first member of
struct vmw_bo (offset 0) so &((struct vmw_bo *)NULL)->tbo evaluates to
exactly NULL. The entire patch is basically a no-op. If you have some
decent static checker that's being tricked by this code and there's
value in unblocking it, please describe your static checker and feel
free to resubmit as a code cleanup, but the above analysis and fhe
fixes tag are incorrect.

z

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5414 bytes --]