On Tue, Oct 13, 2026 at 01:02:05PM +0100, Matt Evans wrote:
> After 4ab59c3c638c6 ("dma-buf: Move dma_buf_release() from fops to
> dentry_ops"), dmabuf->file can close prior to the .release callback
> being invoked.
>
> intel_vgpu_get_dmabuf() exports the dmabuf, then dma_buf_fd()
> effectively transfers its file's reference to the fd. A debug print
> dereferences dmabuf->file after the dma_buf_fd(); however, the fd
> could be closed by another thread, making dmabuf->file stale.
>
> Read file_count() while the reference to dmabuf->file is still held,
> for later debug printing.
>
> Cc: [email protected]
> Fixes: 4ab59c3c638c6 ("dma-buf: Move dma_buf_release() from fops to
> dentry_ops")
> Signed-off-by: Matt Evans <[email protected]>
> ---
> drivers/gpu/drm/i915/gvt/dmabuf.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/i915/gvt/dmabuf.c
> b/drivers/gpu/drm/i915/gvt/dmabuf.c
> index 8a1d6c5636c2..b6f50f2b912d 100644
> --- a/drivers/gpu/drm/i915/gvt/dmabuf.c
> +++ b/drivers/gpu/drm/i915/gvt/dmabuf.c
> @@ -503,6 +503,7 @@ int intel_vgpu_get_dmabuf(struct intel_vgpu *vgpu,
> unsigned int dmabuf_id)
> struct drm_device *dev = &vgpu->gvt->gt->i915->drm;
> struct intel_vgpu_dmabuf_obj *dmabuf_obj;
> struct drm_i915_gem_object *obj;
> + unsigned long db_fcount;
> struct dma_buf *dmabuf;
> int dmabuf_fd;
> int ret = 0;
> @@ -531,6 +532,7 @@ int intel_vgpu_get_dmabuf(struct intel_vgpu *vgpu,
> unsigned int dmabuf_id)
> ret = PTR_ERR(dmabuf);
> goto out_free_gem;
> }
> + db_fcount = file_count(dmabuf->file);
>
> ret = dma_buf_fd(dmabuf, DRM_CLOEXEC | DRM_RDWR);
> if (ret < 0) {
> @@ -552,8 +554,7 @@ int intel_vgpu_get_dmabuf(struct intel_vgpu *vgpu,
> unsigned int dmabuf_id)
> " file count: %ld, GEM ref: %d\n",
> vgpu->id, dmabuf_obj->dmabuf_id,
> kref_read(&dmabuf_obj->kref),
> - dmabuf_fd,
> - file_count(dmabuf->file),
> + dmabuf_fd, db_fcount,
> kref_read(&obj->base.refcount));
>
> i915_gem_object_put(obj);
> --
> 2.47.3
Acked-by: Zhenyu Wang <[email protected]>
