linux-kernel - Re: [PATCH next] drm/nouveau: Fix error pointer dereference in r535_gsp_msgq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250217165633.00004d13@nvidia.com>
Date: Mon, 17 Feb 2025 16:56:33 +0200
From: Zhi Wang <zhiw@...dia.com>
To: Dan Carpenter <dan.carpenter@...aro.org>
CC: Lyude Paul <lyude@...hat.com>, Danilo Krummrich <dakr@...nel.org>, "David
 Airlie" <airlied@...il.com>, Simona Vetter <simona@...ll.ch>, Timur Tabi
	<ttabi@...dia.com>, Dave Airlie <airlied@...hat.com>, Ben Skeggs
	<bskeggs@...dia.com>, <dri-devel@...ts.freedesktop.org>,
	<nouveau@...ts.freedesktop.org>, <linux-kernel@...r.kernel.org>,
	<kernel-janitors@...r.kernel.org>
Subject: Re: [PATCH next] drm/nouveau: Fix error pointer dereference in
 r535_gsp_msgq_recv()

On Mon, 17 Feb 2025 10:31:21 +0300
Dan Carpenter <dan.carpenter@...aro.org> wrote:

Thanks for catching this!

Acked-by: Zhi Wang <zhiw@...dia.com>

> If "rpc" is an error pointer then return directly.  Otherwise it leads
> to an error pointer dereference.
> 
> Fixes: 50f290053d79 ("drm/nouveau: support handling the return of large GSP message")
> Signed-off-by: Dan Carpenter <dan.carpenter@...aro.org>
> ---
>  drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c
> index 2075cad63805..db2602e88006 100644
> --- a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c
> +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c
> @@ -348,6 +348,7 @@ r535_gsp_msgq_recv(struct nvkm_gsp *gsp, u32 gsp_rpc_len, int *retries)
>  	if (IS_ERR(buf)) {
>  		kvfree(info.gsp_rpc_buf);
>  		info.gsp_rpc_buf = NULL;
> +		return buf;
>  	}
>  
>  	if (expected <= max_rpc_size)