]> git.ipfire.org Git - thirdparty/linux.git/commit
drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure
authorZack Rusin <zack.rusin@broadcom.com>
Tue, 5 May 2026 22:22:29 +0000 (18:22 -0400)
committerZack Rusin <zack.rusin@broadcom.com>
Mon, 27 Jul 2026 15:29:24 +0000 (11:29 -0400)
commit05eaa887e7b4f40fba425f8a1d7a5a8a043092a6
treeebf82822db2682dd550ba6fc86ce3fe0907266e5
parentf4f1db96bfd68b81053693ba53405b6f510ac16c
drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure

Two paths through vmw_vkms_init() can leave vmw->crc_workq NULL while
still leaving the rest of the driver in a state that calls
vmw_vkms_cleanup() at module unload:

  1. vmw_host_get_guestinfo(GUESTINFO_VBLANK, ...) failing or
     returning an oversized buffer -- the common case on hosts
     without a VBLANK guestinfo entry -- early-returned before the
     workqueue allocation.
  2. alloc_ordered_workqueue() returning NULL on memory pressure.

vmw_vkms_cleanup() then calls destroy_workqueue(NULL), which
dereferences wq->name and panics.

Fix the first case by removing the early return: vmw->vkms_enabled
is already false on the rpci-failure path so no work will ever be
queued, and allocating the workqueue unconditionally keeps the
control flow simple.  Fix the second case by guarding the cleanup
with a NULL check, since alloc_ordered_workqueue() can still fail
under low memory.

Fixes: 7b0062036c3b ("drm/vmwgfx: Implement virtual crc generation")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4.7
Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
Reviewed-by: Ian Forbes <ian.forbes@broadcom.com>
Link: https://patch.msgid.link/20260505222728.519626-9-zack.rusin@broadcom.com
drivers/gpu/drm/vmwgfx/vmwgfx_vkms.c