linux-kernel - Re: [BUG] BUG: kernel NULL pointer dereference at ttm_device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240122181901.05a3b9ab@gandalf.local.home>
Date: Mon, 22 Jan 2024 18:19:01 -0500
From: Steven Rostedt <rostedt@...dmis.org>
To: LKML <linux-kernel@...r.kernel.org>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>, Rajneesh Bhardwaj
 <rajneesh.bhardwaj@....com>, Felix Kuehling <Felix.Kuehling@....com>,
 Christian König <christian.koenig@....com>,
 dri-devel@...ts.freedesktop.org
Subject: Re: [BUG]  BUG: kernel NULL pointer dereference at
 ttm_device_init+0xb4

On Mon, 22 Jan 2024 18:15:47 -0500
Steven Rostedt <rostedt@...dmis.org> wrote:

> > 	ttm_pool_init(&bdev->pool, dev, dev_to_node(dev), use_dma_alloc, use_dma32); <<<------- BUG!
> > 
> > Specifically, it appears that dev is NULL and dev_to_node() doesn't like
> > having a NULL pointer passed to it.
> >   
> 
> Yeah, that qxl_ttm_init() has:
> 
> 	/* No others user of address space so set it to 0 */
> 	r = ttm_device_init(&qdev->mman.bdev, &qxl_bo_driver, NULL,
> 			    qdev->ddev.anon_inode->i_mapping,
> 			    qdev->ddev.vma_offset_manager,
> 			    false, false);
> 
> Where that NULL is "dev"!
> 
> Thus that will never work here.

Perhaps this is the real fix?

-- Steve

diff --git a/drivers/gpu/drm/ttm/ttm_device.c b/drivers/gpu/drm/ttm/ttm_device.c
index f5187b384ae9..bc217b4d6b04 100644
--- a/drivers/gpu/drm/ttm/ttm_device.c
+++ b/drivers/gpu/drm/ttm/ttm_device.c
@@ -215,7 +215,8 @@ int ttm_device_init(struct ttm_device *bdev, const struct ttm_device_funcs *func
 
 	ttm_sys_man_init(bdev);
 
-	ttm_pool_init(&bdev->pool, dev, dev_to_node(dev), use_dma_alloc, use_dma32);
+	ttm_pool_init(&bdev->pool, dev, dev ? dev_to_node(dev) : NUMA_NO_NODE,
+		      use_dma_alloc, use_dma32);
 
 	bdev->vma_manager = vma_manager;
 	spin_lock_init(&bdev->lru_lock);