All of lore.kernel.org
 help / color / mirror / Atom feed
From: Jackie Liu <liu.yun@linux.dev>
To: kees@kernel.org
Cc: pmladek@suse.com, linux-kernel@vger.kernel.org, liu.yun@linux.dev
Subject: [PATCH] lib: kunit_iov_iter: fix NULL deref in iov_kunit_create_xarray()
Date: Thu, 18 Sep 2025 15:13:16 +0800	[thread overview]
Message-ID: <20250918071316.1035-1-liu.yun@linux.dev> (raw)

From: Jackie Liu <liuyun01@kylinos.cn>

iov_kunit_create_xarray() allocates memory for an xarray using kzalloc()
and then calls xa_init() on the result. However, xa_init() was invoked
before checking the return value of kzalloc(). If kzalloc() fails, this
would lead to a NULL pointer dereference.

Move the KUNIT_ASSERT_NOT_ERR_OR_NULL() check before xa_init() to ensure
the pointer is valid before initialization.

Fixes: 2d71340ff1d4 ("iov_iter: Kunit tests for copying to/from an iterator")
Signed-off-by: Jackie Liu <liuyun01@kylinos.cn>
---
 lib/tests/kunit_iov_iter.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tests/kunit_iov_iter.c b/lib/tests/kunit_iov_iter.c
index 48342736d016..a9d6db89247d 100644
--- a/lib/tests/kunit_iov_iter.c
+++ b/lib/tests/kunit_iov_iter.c
@@ -566,8 +566,8 @@ static struct xarray *iov_kunit_create_xarray(struct kunit *test)
 	struct xarray *xarray;
 
 	xarray = kzalloc(sizeof(struct xarray), GFP_KERNEL);
-	xa_init(xarray);
 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, xarray);
+	xa_init(xarray);
 	kunit_add_action_or_reset(test, iov_kunit_destroy_xarray, xarray);
 	return xarray;
 }
-- 
2.51.0


                 reply	other threads:[~2025-09-18  7:14 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20250918071316.1035-1-liu.yun@linux.dev \
    --to=liu.yun@linux.dev \
    --cc=kees@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=pmladek@suse.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.