linux-kernel - [PATCH] DRM: Fix rbtree search issue of find_hole

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20250523083909.84517-2-junan76@163.com>
Date: Fri, 23 May 2025 16:39:10 +0800
From: junan <junan76@....com>
To: maarten.lankhorst@...ux.intel.com,
	mripard@...nel.org,
	airlied@...il.com,
	simona@...ll.ch,
	tzimmermann@...e.de
Cc: dri-devel@...ts.freedesktop.org,
	linux-kernel@...r.kernel.org,
	junan76@....com
Subject: [PATCH] DRM: Fix rbtree search issue of find_hole_addr

I'm not sure if it is a bug or just for some special purposes in the function
"find_hole_addr", the original implementation is as follows:

static struct drm_mm_node *find_hole_addr(struct drm_mm *mm, u64 addr, u64 size)
{
	struct rb_node *rb = mm->holes_addr.rb_node;
	struct drm_mm_node *node = NULL;

	while (rb) {
		u64 hole_start;

		if (!usable_hole_addr(rb, size))
			break;

		node = rb_hole_addr_to_node(rb);
		hole_start = __drm_mm_hole_node_start(node);

		if (addr < hole_start)
			rb = node->rb_hole_addr.rb_left;
		else if (addr > hole_start + node->hole_size)
			rb = node->rb_hole_addr.rb_right;
		else
			break;

	}

	return node;
}

I think that the "node" should be set to NULL if it is not the one we want,
please tell me if I am wrong.

Signed-off-by: junan <junan76@....com>
---
 drivers/gpu/drm/drm_mm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
index ca254611b382..9417911198b5 100644
--- a/drivers/gpu/drm/drm_mm.c
+++ b/drivers/gpu/drm/drm_mm.c
@@ -347,6 +347,8 @@ static struct drm_mm_node *find_hole_addr(struct drm_mm *mm, u64 addr, u64 size)
 			rb = node->rb_hole_addr.rb_right;
 		else
 			break;
+
+		node = NULL;
 	}
 
 	return node;
-- 
2.43.5