linux-kernel - Re: [PATCH] drm/ttm/tests: fix potential null pointer dereference in ttm_bo_unreserve

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <Z9L9tbL7fWxw3yb4@qasdev.system>
Date: Thu, 13 Mar 2025 15:46:13 +0000
From: Qasim Ijaz <qasdev00@...il.com>
To: Christian König <christian.koenig@....com>
Cc: ray.huang@....com, maarten.lankhorst@...ux.intel.com,
	mripard@...nel.org, tzimmermann@...e.de, airlied@...il.com,
	simona@...ll.ch, thomas.hellstrom@...ux.intel.com,
	Arunpravin.PaneerSelvam@....com, karolina.stolarek@...el.com,
	jeff.johnson@....qualcomm.com, bigeasy@...utronix.de,
	dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org,
	stable@...r.kernel.org
Subject: Re: [PATCH] drm/ttm/tests: fix potential null pointer dereference in
 ttm_bo_unreserve_bulk()

On Thu, Mar 13, 2025 at 03:20:34PM +0100, Christian König wrote:
> Am 11.03.25 um 20:01 schrieb Qasim Ijaz:
> > In the ttm_bo_unreserve_bulk() test function, resv is allocated 
> > using kunit_kzalloc(), but the subsequent assertion mistakenly 
> > verifies the ttm_dev pointer instead of checking the resv pointer. 
> > This mistake means that if allocation for resv fails, the error will 
> > go undetected, resv will be NULL and a call to dma_resv_init(resv) 
> 
> The description here is correct, but the subject line is a bit misleading.
> 
> Please use something like this instead "drm/ttm/tests: incorrect assert in ttm_bo_unreserve_bulk()".
> 
> > will dereference a NULL pointer. 
> 
> That irrelevant, an allocation failure will result in a NULL pointer deref anyway. This is just an unit test.
> 
> >
> > Fix the assertion to properly verify the resv pointer.
> >
> > Fixes: 588c4c8d58c4 ("drm/ttm/tests: Fix a warning in ttm_bo_unreserve_bulk")
> > Cc: stable@...r.kernel.org
> 
> Please drop those tags. This is just an unit test, not relevant for stability and therefore shouldn't be backported.
> 
> Regards,
> Christian.
> 
Thank you for the feedback Christian, I will resend a new patch with the
changes you described.

Thanks,
Qasim.
> > Signed-off-by: Qasim Ijaz <qasdev00@...il.com>
> > ---
> >  drivers/gpu/drm/ttm/tests/ttm_bo_test.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/gpu/drm/ttm/tests/ttm_bo_test.c b/drivers/gpu/drm/ttm/tests/ttm_bo_test.c
> > index f8f20d2f6174..e08e5a138420 100644
> > --- a/drivers/gpu/drm/ttm/tests/ttm_bo_test.c
> > +++ b/drivers/gpu/drm/ttm/tests/ttm_bo_test.c
> > @@ -340,7 +340,7 @@ static void ttm_bo_unreserve_bulk(struct kunit *test)
> >  	KUNIT_ASSERT_NOT_NULL(test, ttm_dev);
> >  
> >  	resv = kunit_kzalloc(test, sizeof(*resv), GFP_KERNEL);
> > -	KUNIT_ASSERT_NOT_NULL(test, ttm_dev);
> > +	KUNIT_ASSERT_NOT_NULL(test, resv);
> >  
> >  	err = ttm_device_kunit_init(priv, ttm_dev, false, false);
> >  	KUNIT_ASSERT_EQ(test, err, 0);
>