From: Sebastian Brzezinka Date: Tue, 3 Mar 2026 12:26:42 +0000 (+0100) Subject: drm/ttm: fix NULL deref in ttm_bo_flush_all_fences() after fence ops detach X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=21613f67ede11e495281b4a6dde72cd7db3ada4e;p=thirdparty%2Flinux.git drm/ttm: fix NULL deref in ttm_bo_flush_all_fences() after fence ops detach Since commit 541c8f2468b9 ("dma-buf: detach fence ops on signal v3"), fence->ops may be set to NULL via RCU when a fence signals and has no release/wait ops. ttm_bo_flush_all_fences() was not updated to handle this and directly dereferences fence->ops->signaled, leading to a NULL pointer dereference crash: ``` BUG: kernel NULL pointer dereference, address: 0000000000000018 RIP: 0010:ttm_bo_release+0x1bc/0x330 [ttm] ``` Since dma_fence_enable_sw_signaling() already handles the signaled case internally (it checks DMA_FENCE_FLAG_SIGNALED_BIT before doing anything), the ops->signaled pre-check is redundant. Simply remove it and call dma_fence_enable_sw_signaling() unconditionally for each fence. Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15759 Fixes: 541c8f2468b9 ("dma-buf: detach fence ops on signal v3") Cc: Christian König Signed-off-by: Sebastian Brzezinka Reviewed-by: Christian König Reviewed-by: Andi Shyti Signed-off-by: Christian König Link: https://lore.kernel.org/r/1c2f34351b6fb70ab576aeac07987542a4d480b2.1772540459.git.sebastian.brzezinka@intel.com --- diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c index acb9197db8798..0485ad00a3df6 100644 --- a/drivers/gpu/drm/ttm/ttm_bo.c +++ b/drivers/gpu/drm/ttm/ttm_bo.c @@ -222,10 +222,8 @@ static void ttm_bo_flush_all_fences(struct ttm_buffer_object *bo) struct dma_fence *fence; dma_resv_iter_begin(&cursor, resv, DMA_RESV_USAGE_BOOKKEEP); - dma_resv_for_each_fence_unlocked(&cursor, fence) { - if (!fence->ops->signaled) - dma_fence_enable_sw_signaling(fence); - } + dma_resv_for_each_fence_unlocked(&cursor, fence) + dma_fence_enable_sw_signaling(fence); dma_resv_iter_end(&cursor); }