linux-kernel - Re: [PATCH] drm/ttm/tests: fix potential null pointer dereference in ttm_bo_unreserve

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <6a24d733-88ef-4cfb-8cc8-1c01fb64fc0f@amd.com>
Date: Thu, 13 Mar 2025 15:20:34 +0100
From: Christian König <christian.koenig@....com>
To: Qasim Ijaz <qasdev00@...il.com>, ray.huang@....com,
 maarten.lankhorst@...ux.intel.com, mripard@...nel.org, tzimmermann@...e.de,
 airlied@...il.com, simona@...ll.ch, thomas.hellstrom@...ux.intel.com,
 Arunpravin.PaneerSelvam@....com, karolina.stolarek@...el.com,
 jeff.johnson@....qualcomm.com, bigeasy@...utronix.de
Cc: dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org,
 stable@...r.kernel.org
Subject: Re: [PATCH] drm/ttm/tests: fix potential null pointer dereference in
 ttm_bo_unreserve_bulk()

Am 11.03.25 um 20:01 schrieb Qasim Ijaz:
> In the ttm_bo_unreserve_bulk() test function, resv is allocated 
> using kunit_kzalloc(), but the subsequent assertion mistakenly 
> verifies the ttm_dev pointer instead of checking the resv pointer. 
> This mistake means that if allocation for resv fails, the error will 
> go undetected, resv will be NULL and a call to dma_resv_init(resv) 

The description here is correct, but the subject line is a bit misleading.

Please use something like this instead "drm/ttm/tests: incorrect assert in ttm_bo_unreserve_bulk()".

> will dereference a NULL pointer. 

That irrelevant, an allocation failure will result in a NULL pointer deref anyway. This is just an unit test.

>
> Fix the assertion to properly verify the resv pointer.
>
> Fixes: 588c4c8d58c4 ("drm/ttm/tests: Fix a warning in ttm_bo_unreserve_bulk")
> Cc: stable@...r.kernel.org

Please drop those tags. This is just an unit test, not relevant for stability and therefore shouldn't be backported.

Regards,
Christian.

> Signed-off-by: Qasim Ijaz <qasdev00@...il.com>
> ---
>  drivers/gpu/drm/ttm/tests/ttm_bo_test.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/ttm/tests/ttm_bo_test.c b/drivers/gpu/drm/ttm/tests/ttm_bo_test.c
> index f8f20d2f6174..e08e5a138420 100644
> --- a/drivers/gpu/drm/ttm/tests/ttm_bo_test.c
> +++ b/drivers/gpu/drm/ttm/tests/ttm_bo_test.c
> @@ -340,7 +340,7 @@ static void ttm_bo_unreserve_bulk(struct kunit *test)
>  	KUNIT_ASSERT_NOT_NULL(test, ttm_dev);
>  
>  	resv = kunit_kzalloc(test, sizeof(*resv), GFP_KERNEL);
> -	KUNIT_ASSERT_NOT_NULL(test, ttm_dev);
> +	KUNIT_ASSERT_NOT_NULL(test, resv);
>  
>  	err = ttm_device_kunit_init(priv, ttm_dev, false, false);
>  	KUNIT_ASSERT_EQ(test, err, 0);