linux-kernel - Re: [PATCH] drm/i915/gt: Avoid redundant pointer validity check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aa8af778-2a40-7fe0-eb14-234469c74523@intel.com>
Date:   Mon, 6 Feb 2023 10:33:13 +0000
From:   Matthew Auld <matthew.auld@...el.com>
To:     Tvrtko Ursulin <tvrtko.ursulin@...ux.intel.com>,
        Deepak R Varma <drv@...lo.com>,
        Jani Nikula <jani.nikula@...ux.intel.com>,
        Joonas Lahtinen <joonas.lahtinen@...ux.intel.com>,
        Rodrigo Vivi <rodrigo.vivi@...el.com>,
        David Airlie <airlied@...il.com>,
        Daniel Vetter <daniel@...ll.ch>,
        intel-gfx@...ts.freedesktop.org, dri-devel@...ts.freedesktop.org,
        linux-kernel@...r.kernel.org,
        Thomas Hellstrom <thomas.hellstrom@...el.com>
Cc:     Saurabh Singh Sengar <ssengar@...rosoft.com>,
        Praveen Kumar <kumarpraveen@...ux.microsoft.com>
Subject: Re: [PATCH] drm/i915/gt: Avoid redundant pointer validity check

On 06/02/2023 09:45, Tvrtko Ursulin wrote:
> 
> Hi,
> 
> Adding Matt & Thomas as potential candidates to review.
> 
> Regards,
> 
> Tvrtko
> 
> On 03/02/2023 19:30, Deepak R Varma wrote:
>> The macro definition of gen6_for_all_pdes() expands to a for loop such
>> that it breaks when the page table is null. Hence there is no need to
>> again test validity of the page table entry pointers in the pde list.
>> This change is identified using itnull.cocci semantic patch.
>>
>> Signed-off-by: Deepak R Varma <drv@...lo.com>
>> ---
>> Please note: Proposed change is compile tested only.
>>
>>   drivers/gpu/drm/i915/gt/gen6_ppgtt.c | 5 ++---
>>   1 file changed, 2 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/i915/gt/gen6_ppgtt.c 
>> b/drivers/gpu/drm/i915/gt/gen6_ppgtt.c
>> index 5aaacc53fa4c..787b9e6d9f59 100644
>> --- a/drivers/gpu/drm/i915/gt/gen6_ppgtt.c
>> +++ b/drivers/gpu/drm/i915/gt/gen6_ppgtt.c
>> @@ -258,8 +258,7 @@ static void gen6_ppgtt_free_pd(struct gen6_ppgtt 
>> *ppgtt)
>>       u32 pde;
>>       gen6_for_all_pdes(pt, pd, pde)
>> -        if (pt)
>> -            free_pt(&ppgtt->base.vm, pt);
>> +        free_pt(&ppgtt->base.vm, pt);
>>   }
>>   static void gen6_ppgtt_cleanup(struct i915_address_space *vm)
>> @@ -304,7 +303,7 @@ static void pd_vma_unbind(struct 
>> i915_address_space *vm,
>>       /* Free all no longer used page tables */
>>       gen6_for_all_pdes(pt, ppgtt->base.pd, pde) {
>> -        if (!pt || atomic_read(&pt->used))
>> +        if (atomic_read(&pt->used))

Wow, I was really confused trying to remember how this all works.

The gen6_for_all_pdes() does:

(pt = i915_pt_entry(pd, iter), true)

So NULL pt is expected, and does not 'break' here, since 'true' is 
always the value that decides whether to terminate the loop. So this 
patch would lead to NULL ptr deref, AFAICT.



>>               continue;
>>           free_pt(&ppgtt->base.vm, pt);