linux-kernel - Re: [PATCH] drm/xe/hw_engine_group: Fix bad free in xe_hw_engine_setup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZzWqnIGZEv-_-Lbc@bvivekan-mobl1>
Date: Thu, 14 Nov 2024 13:15:32 +0530
From: "Vivekanandan, Balasubramani" <balasubramani.vivekanandan@...el.com>
To: Su Hui <suhui@...china.com>, <lucas.demarchi@...el.com>,
	<thomas.hellstrom@...ux.intel.com>, <rodrigo.vivi@...el.com>,
	<maarten.lankhorst@...ux.intel.com>, <mripard@...nel.org>,
	<tzimmermann@...e.de>, <airlied@...il.com>, <simona@...ll.ch>,
	<nathan@...nel.org>, <ndesaulniers@...gle.com>, <morbo@...gle.com>,
	<justinstitt@...gle.com>
CC: <matthew.brost@...el.com>, <francois.dugast@...el.com>,
	<intel-xe@...ts.freedesktop.org>, <dri-devel@...ts.freedesktop.org>,
	<linux-kernel@...r.kernel.org>, <llvm@...ts.linux.dev>,
	<kernel-janitors@...r.kernel.org>
Subject: Re: [PATCH] drm/xe/hw_engine_group: Fix bad free in
 xe_hw_engine_setup_groups()

On 14.11.2024 14:39, Su Hui wrote:
> Clang static checker(scan-build) warning：
> drivers/gpu/drm/xe/xe_hw_engine_group.c: line 134, column 2
> Argument to kfree() is a constant address (18446744073709551604), which
> is not memory allocated by malloc().
> 
> There are some problems in hw_engine_group_alloc() and
> xe_hw_engine_setup_groups(). First, kfree() can only handle NULL
> pointers instead of negitave error codes. When hw_engine_group_alloc()
> failed, there is a bad kfree call for negitave error codes in
> xe_hw_engine_setup_groups(). Second, when drmm_add_action_or_reset()
> failed, destroy_workqueue() should be called to free 'group->resume_wq'.
> 
> Free 'group' and destroy 'group->resume_wq' when hw_engine_group_alloc()
> failed to fix these problems.
> 
> Fixes: d16ef1a18e39 ("drm/xe/exec: Switch hw engine group execution mode upon job submission")
> Fixes: f784750c670f ("drm/xe/hw_engine_group: Introduce xe_hw_engine_group")
> Signed-off-by: Su Hui <suhui@...china.com>
> ---
>  drivers/gpu/drm/xe/xe_hw_engine_group.c | 31 ++++++++++++++-----------
>  1 file changed, 17 insertions(+), 14 deletions(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_hw_engine_group.c b/drivers/gpu/drm/xe/xe_hw_engine_group.c
> index 82750520a90a..ee2cb32817fa 100644
> --- a/drivers/gpu/drm/xe/xe_hw_engine_group.c
> +++ b/drivers/gpu/drm/xe/xe_hw_engine_group.c
> @@ -51,7 +51,7 @@ static struct xe_hw_engine_group *
>  hw_engine_group_alloc(struct xe_device *xe)
>  {
>  	struct xe_hw_engine_group *group;
> -	int err;
> +	int err = -ENOMEM;
>  
>  	group = kzalloc(sizeof(*group), GFP_KERNEL);
>  	if (!group)
> @@ -59,7 +59,7 @@ hw_engine_group_alloc(struct xe_device *xe)
>  
>  	group->resume_wq = alloc_workqueue("xe-resume-lr-jobs-wq", 0, 0);
>  	if (!group->resume_wq)
> -		return ERR_PTR(-ENOMEM);
> +		goto free_group;
kfree can be directly called from here followed by return, instead of a
goto.

>  
>  	init_rwsem(&group->mode_sem);
>  	INIT_WORK(&group->resume_work, hw_engine_group_resume_lr_jobs_func);
> @@ -67,9 +67,15 @@ hw_engine_group_alloc(struct xe_device *xe)
>  
>  	err = drmm_add_action_or_reset(&xe->drm, hw_engine_group_free, group);
>  	if (err)
> -		return ERR_PTR(err);
> +		goto destroy_wq;
There is no need to clear the resources on failure, because
drmm_add_action_or_reset takes care of freeing the resources on
failure.

>  
>  	return group;
> +
> +destroy_wq:
> +	destroy_workqueue(group->resume_wq);
> +free_group:
> +	kfree(group);
> +	return ERR_PTR(err);
>  }
>  
>  /**
> @@ -87,21 +93,19 @@ int xe_hw_engine_setup_groups(struct xe_gt *gt)
>  	int err;
>  
>  	group_rcs_ccs = hw_engine_group_alloc(xe);
> -	if (IS_ERR(group_rcs_ccs)) {
> -		err = PTR_ERR(group_rcs_ccs);
> -		goto err_group_rcs_ccs;
> -	}
> +	if (IS_ERR(group_rcs_ccs))
> +		return PTR_ERR(group_rcs_ccs);
>  
>  	group_bcs = hw_engine_group_alloc(xe);
>  	if (IS_ERR(group_bcs)) {
>  		err = PTR_ERR(group_bcs);
> -		goto err_group_bcs;
> +		goto free_group_rcs_ccs;
No need of freeing the memory here and in the following lines as we have
managed it through the drmm_add_action_or_reset call in
hw_engine_group_alloc.
We can simply return the error code.

>  	}
>  
>  	group_vcs_vecs = hw_engine_group_alloc(xe);
>  	if (IS_ERR(group_vcs_vecs)) {
>  		err = PTR_ERR(group_vcs_vecs);
> -		goto err_group_vcs_vecs;
> +		goto free_group_bcs;
>  	}
>  
>  	for_each_hw_engine(hwe, gt, id) {
> @@ -126,13 +130,12 @@ int xe_hw_engine_setup_groups(struct xe_gt *gt)
>  
>  	return 0;
>  
> -err_group_vcs_vecs:
> -	kfree(group_vcs_vecs);
> -err_group_bcs:
> +free_group_bcs:
> +	destroy_workqueue(group_bcs->resume_wq);
>  	kfree(group_bcs);
> -err_group_rcs_ccs:
> +free_group_rcs_ccs:
> +	destroy_workqueue(group_rcs_ccs->resume_wq);
>  	kfree(group_rcs_ccs);
> -
All these kfree statements are not required.

Regards,
Bala
>  	return err;
>  }
>  
> -- 
> 2.30.2
>