linux-kernel - Re: [PATCH] drm/nouveau/gsp: fix mismatched alloc/free for kvmalloc()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <f9306eb1-2268-4a8d-9c7b-384fb89bae52@nvidia.com>
Date: Wed, 13 Aug 2025 11:01:14 +0000
From: Zhi Wang <zhiw@...dia.com>
To: Timur Tabi <ttabi@...dia.com>, "rongqianfeng@...o.com"
	<rongqianfeng@...o.com>, "airlied@...hat.com" <airlied@...hat.com>,
	"simona@...ll.ch" <simona@...ll.ch>, "lyude@...hat.com" <lyude@...hat.com>,
	"dri-devel@...ts.freedesktop.org" <dri-devel@...ts.freedesktop.org>,
	"nouveau@...ts.freedesktop.org" <nouveau@...ts.freedesktop.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"dakr@...nel.org" <dakr@...nel.org>
Subject: Re: [PATCH] drm/nouveau/gsp: fix mismatched alloc/free for kvmalloc()

On 13/08/2025 1.52, Timur Tabi wrote:
> On Mon, 2025-08-11 at 17:19 +0800, Qianfeng Rong wrote:
>> Replace kfree() with kvfree() for memory allocated by kvmalloc().
>>
>> Compile-tested only.
>>
>> Signed-off-by: Qianfeng Rong <rongqianfeng@...o.com>
> 
> Reviewed-by: Timur Tabi <ttabi@...dia.com>
> 
> This does fix a real bug.
> 

Agree with the coding details.

I felt the core issue is that GSP RPC lifecycle management in NVKM is 
not handled cleanly. For example, the caller’s RPC buffer is freed 
silently in the receive path, and a new buffer is allocated and returned 
without explicit coordination.

Introducing large GSP RPCs - such as factoring out 
r535_gsp_msgq_recv_one_elem() - only makes this flaw more apparent, and 
even the refactoring process is cumbersome and tricky.

Ideally, there should be a clear ownership and lifecycle flow between 
the caller and the GSP RPC routines: the caller allocates and frees the 
RPC buffer, while the low-level routines focus solely on send/receive 
operations. r535_gsp_msgq_recv_one_elem() is just on its half way.

Z.

> However, I think the real problem is that it's really confusing that
> r535_gsp_msgq_recv_one_elem(gsp, &info) returns info.gsp_rpc_buf instead of just success/failure.
> r535_gsp_msgq_recv() does this:
> 
> 	buf = kvmalloc(max_t(u32, rpc->length, expected), GFP_KERNEL);
> ...
> 	info.gsp_rpc_buf = buf;
> ...
> 	buf = r535_gsp_msgq_recv_one_elem(gsp, &info);
> 
> You wouldn't know it, but this does not change the value of 'buf' unless
> r535_gsp_msgq_recv_one_elem() fails.  If it does fail, the code does this:
> 
> 	if (IS_ERR(buf)) {
> 		kvfree(info.gsp_rpc_buf);
> 
> It would be a lot clearer if we could kvfree(buf) here, but we can't because 'buf' no longer points
> to the buffer, even though the buffer still exists.
> 
>