linux-kernel - Re: [PATCH] drm/xe/guc: Fix deference after check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <a156ef31-2614-41c9-9df6-acd6d2fcf6cb@linux.intel.com>
Date: Wed, 9 Oct 2024 10:00:36 +0200
From: Nirmoy Das <nirmoy.das@...ux.intel.com>
To: "Everest K.C." <everestkc@...restkc.com.np>, lucas.demarchi@...el.com,
 thomas.hellstrom@...ux.intel.com, rodrigo.vivi@...el.com,
 maarten.lankhorst@...ux.intel.com, mripard@...nel.org, tzimmermann@...e.de,
 airlied@...il.com, simona@...ll.ch
Cc: skhan@...uxfoundation.org, intel-xe@...ts.freedesktop.org,
 dri-devel@...ts.freedesktop.org, kernel-janitors@...r.kernel.org,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH] drm/xe/guc: Fix deference after check


On 10/8/2024 10:53 PM, Everest K.C. wrote:
> The `if (!snapshot->copy)` evaluates to True only when `snapshot->copy`
> is Null. Thus, derefrencing `snapshot->copy` inside this if block is
> equivalent to Null pointer derefrencing.
> The `if` condition is now changed to evaluate to true only when
> `snapshot->copy` is not Null.
> This issue was reported by Coverity Scan.
>
> Signed-off-by: Everest K.C. <everestkc@...restkc.com.np>

Fixes: d8ce1a977226 ("drm/xe/guc: Use a two stage dump for GuC logs and add more info")

Reviewed-by: Nirmoy Das <nirmoy.das@...el.com>

> ---
>  drivers/gpu/drm/xe/xe_guc_log.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/xe/xe_guc_log.c b/drivers/gpu/drm/xe/xe_guc_log.c
> index 7fbc56cceaba..4e1a5e8ba1e3 100644
> --- a/drivers/gpu/drm/xe/xe_guc_log.c
> +++ b/drivers/gpu/drm/xe/xe_guc_log.c
> @@ -122,7 +122,7 @@ void xe_guc_log_snapshot_free(struct xe_guc_log_snapshot *snapshot)
>  	if (!snapshot)
>  		return;
>  
> -	if (!snapshot->copy) {
> +	if (snapshot->copy) {
>  		for (i = 0; i < snapshot->num_chunks; i++)
>  			kfree(snapshot->copy[i]);
>  		kfree(snapshot->copy);