linux-kernel - Re: [lvc-project] [PATCH] gpu: i915: fix error return in mmap_offset

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250925112453-9f2adbf071ed0db667442c83-pchelkin@ispras>
Date: Thu, 25 Sep 2025 11:32:50 +0300
From: Fedor Pchelkin <pchelkin@...ras.ru>
To: Alexandr Sapozhnkiov <alsp705@...il.com>
Cc: Jani Nikula <jani.nikula@...ux.intel.com>, 
	Andi Shyti <andi.shyti@...nel.org>, Krzysztof Karas <krzysztof.karas@...el.com>, 
	Joonas Lahtinen <joonas.lahtinen@...ux.intel.com>, Rodrigo Vivi <rodrigo.vivi@...el.com>, 
	Tvrtko Ursulin <tursulin@...ulin.net>, David Airlie <airlied@...il.com>, 
	Daniel Vetter <daniel@...ll.ch>, intel-gfx@...ts.freedesktop.org, dri-devel@...ts.freedesktop.org, 
	linux-kernel@...r.kernel.org, lvc-project@...uxtesting.org, linux-media@...r.kernel.org
Subject: Re: [lvc-project] [PATCH] gpu: i915: fix error return in
 mmap_offset_attach()

On Wed, 24. Sep 15:48, Alexandr Sapozhnkiov wrote:
> Return value of function drm_vma_node_allow_once(), 
> called at i915_gem_mman.c:672, is not checked.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Signed-off-by: Alexandr Sapozhnikov <alsp705@...il.com>
> ---
>  drivers/gpu/drm/i915/gem/i915_gem_mman.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/i915/gem/i915_gem_mman.c b/drivers/gpu/drm/i915/gem/i915_gem_mman.c
> index 75f5b0e871ef..eb76f8f2bd95 100644
> --- a/drivers/gpu/drm/i915/gem/i915_gem_mman.c
> +++ b/drivers/gpu/drm/i915/gem/i915_gem_mman.c
> @@ -758,8 +758,11 @@ mmap_offset_attach(struct drm_i915_gem_object *obj,
>  	mmo = insert_mmo(obj, mmo);
>  	GEM_BUG_ON(lookup_mmo(obj, mmap_type) != mmo);
>  out:
> -	if (file)
> -		drm_vma_node_allow_once(&mmo->vma_node, file);
> +	if (file) {
> +		err = drm_vma_node_allow_once(&mmo->vma_node, file);
> +		if (err)
> +			goto err;

insert_mmo() inserts mmo into rb tree associated with obj.  So it should
be removed from the tree before mmo is freed on error path.

Is it probably better to return directly without going to the 'err' label?
There should be no memory leaks in such case I guess.

> +	}
>  	return mmo;
>  
>  err:
> -- 
> 2.43.0