linux-kernel - Re: [PATCH] drm/panthor: avoid garbage value in panthor_ioctl_dev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0bcdc44e-6921-3658-6651-28ec8330f402@nfschina.com>
Date: Mon, 20 Jan 2025 16:42:38 +0800
From: Su Hui <suhui@...china.com>
To: Dan Carpenter <dan.carpenter@...aro.org>
Cc: boris.brezillon@...labora.com, steven.price@....com, liviu.dudau@....com,
 maarten.lankhorst@...ux.intel.com, mripard@...nel.org, tzimmermann@...e.de,
 airlied@...il.com, simona@...ll.ch, mary.guillemard@...labora.com,
 dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org,
 kernel-janitors@...r.kernel.org
Subject: Re: [PATCH] drm/panthor: avoid garbage value in
 panthor_ioctl_dev_query()

On 2025/1/20 15:21, Dan Carpenter wrote:
> On Sun, Jan 19, 2025 at 10:58:29AM +0800, Su Hui wrote:
>> 'priorities_info' is uninitialized, and the uninitialized value is copied
>> to user object when calling PANTHOR_UOBJ_SET(). Using memset to initialize
>> 'priorities_info' to avoid this garbage value problem.
>>
>> Fixes: f70000ef2352 ("drm/panthor: Add DEV_QUERY_GROUP_PRIORITIES_INFO dev query")
>> Signed-off-by: Su Hui <suhui@...china.com>
> Reviewed-by: Dan Carpenter <dan.carpenter@...aro.org>
>
> How did you find this bug?
Clang found this bug, run command like this:
scan-build  --use-cc=clang    make CC=clang 
drivers/gpu/drm/panthor/panthor_drv.o

There will be some warnings, one is this:
drivers/gpu/drm/panthor/panthor_drv.c:807:22: warning: The left 
expression of the compound
assignment is an uninitialized value. The computed value will also be 
garbage [core.uninitialized.Assign]
   807 |                         arg->allowed_mask |= BIT(prio);
       |                         ~~~~~~~~~~~~~~~~~ ^


regards,
su hui