From: Sumit Garg <sumit.garg@kernel.org>
To: Ally Heev <allyheev@gmail.com>
Cc: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>,
Jens Wiklander <jens.wiklander@linaro.org>,
linux-arm-msm@vger.kernel.org, op-tee@lists.trustedfirmware.org,
linux-kernel@vger.kernel.org,
Dan Carpenter <dan.carpenter@linaro.org>
Subject: Re: [PATCH v3] tee: qcomtee: fix uninitialized pointers with free attribute
Date: Wed, 12 Nov 2025 13:23:49 +0530 [thread overview]
Message-ID: <aRQ9DQ1Ncf4Iep4o@sumit-X1> (raw)
In-Reply-To: <20251111-aheev-uninitialized-free-attr-tee-v3-1-57905b913359@gmail.com>
On Tue, Nov 11, 2025 at 01:26:42PM +0530, Ally Heev wrote:
> Uninitialized pointers with `__free` attribute can cause undefined
> behavior as the memory assigned randomly to the pointer is freed
> automatically when the pointer goes out of scope.
>
> qcomtee doesn't have any bugs related to this as of now, but
> it is better to initialize and assign pointers with `__free`
> attribute in one statement to ensure proper scope-based cleanup
>
> Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
> Closes: https://lore.kernel.org/all/aPiG_F5EBQUjZqsl@stanley.mountain/
> Signed-off-by: Ally Heev <allyheev@gmail.com>
> ---
> Changes in v3:
> - fixed commit message and description
> - Link to v2: https://lore.kernel.org/r/20251110-aheev-uninitialized-free-attr-tee-v2-1-023ffba9ea0f@gmail.com
>
> Changes in v2:
> - initializing variables to NULL at the declaration
> - Link to v1: https://lore.kernel.org/r/20251105-aheev-uninitialized-free-attr-tee-v1-1-2e1ee8483bc5@gmail.com
> ---
> drivers/tee/qcomtee/call.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
-Sumit
>
> diff --git a/drivers/tee/qcomtee/call.c b/drivers/tee/qcomtee/call.c
> index ac134452cc9cfd384c28d41547545f2c5748d86c..65f9140d4e1f8909d072004fd24730543e320d74 100644
> --- a/drivers/tee/qcomtee/call.c
> +++ b/drivers/tee/qcomtee/call.c
> @@ -645,7 +645,7 @@ static void qcomtee_get_version(struct tee_device *teedev,
> static void qcomtee_get_qtee_feature_list(struct tee_context *ctx, u32 id,
> u32 *version)
> {
> - struct qcomtee_object_invoke_ctx *oic __free(kfree);
> + struct qcomtee_object_invoke_ctx *oic __free(kfree) = NULL;
> struct qcomtee_object *client_env, *service;
> struct qcomtee_arg u[3] = { 0 };
> int result;
>
> ---
> base-commit: c9cfc122f03711a5124b4aafab3211cf4d35a2ac
> change-id: 20251105-aheev-uninitialized-free-attr-tee-0221e45ec5a2
>
> Best regards,
> --
> Ally Heev <allyheev@gmail.com>
>
WARNING: multiple messages have this Message-ID (diff)
From: Sumit Garg via OP-TEE <op-tee@lists.trustedfirmware.org>
To: Ally Heev <allyheev@gmail.com>
Cc: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>,
linux-arm-msm@vger.kernel.org, op-tee@lists.trustedfirmware.org,
linux-kernel@vger.kernel.org,
Dan Carpenter <dan.carpenter@linaro.org>
Subject: Re: [PATCH v3] tee: qcomtee: fix uninitialized pointers with free attribute
Date: Wed, 12 Nov 2025 13:23:49 +0530 [thread overview]
Message-ID: <aRQ9DQ1Ncf4Iep4o@sumit-X1> (raw)
In-Reply-To: <20251111-aheev-uninitialized-free-attr-tee-v3-1-57905b913359@gmail.com>
On Tue, Nov 11, 2025 at 01:26:42PM +0530, Ally Heev wrote:
> Uninitialized pointers with `__free` attribute can cause undefined
> behavior as the memory assigned randomly to the pointer is freed
> automatically when the pointer goes out of scope.
>
> qcomtee doesn't have any bugs related to this as of now, but
> it is better to initialize and assign pointers with `__free`
> attribute in one statement to ensure proper scope-based cleanup
>
> Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
> Closes: https://lore.kernel.org/all/aPiG_F5EBQUjZqsl@stanley.mountain/
> Signed-off-by: Ally Heev <allyheev@gmail.com>
> ---
> Changes in v3:
> - fixed commit message and description
> - Link to v2: https://lore.kernel.org/r/20251110-aheev-uninitialized-free-attr-tee-v2-1-023ffba9ea0f@gmail.com
>
> Changes in v2:
> - initializing variables to NULL at the declaration
> - Link to v1: https://lore.kernel.org/r/20251105-aheev-uninitialized-free-attr-tee-v1-1-2e1ee8483bc5@gmail.com
> ---
> drivers/tee/qcomtee/call.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
-Sumit
>
> diff --git a/drivers/tee/qcomtee/call.c b/drivers/tee/qcomtee/call.c
> index ac134452cc9cfd384c28d41547545f2c5748d86c..65f9140d4e1f8909d072004fd24730543e320d74 100644
> --- a/drivers/tee/qcomtee/call.c
> +++ b/drivers/tee/qcomtee/call.c
> @@ -645,7 +645,7 @@ static void qcomtee_get_version(struct tee_device *teedev,
> static void qcomtee_get_qtee_feature_list(struct tee_context *ctx, u32 id,
> u32 *version)
> {
> - struct qcomtee_object_invoke_ctx *oic __free(kfree);
> + struct qcomtee_object_invoke_ctx *oic __free(kfree) = NULL;
> struct qcomtee_object *client_env, *service;
> struct qcomtee_arg u[3] = { 0 };
> int result;
>
> ---
> base-commit: c9cfc122f03711a5124b4aafab3211cf4d35a2ac
> change-id: 20251105-aheev-uninitialized-free-attr-tee-0221e45ec5a2
>
> Best regards,
> --
> Ally Heev <allyheev@gmail.com>
>
next prev parent reply other threads:[~2025-11-12 7:53 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-11-11 7:56 [PATCH v3] tee: qcomtee: fix uninitialized pointers with free attribute Ally Heev
2025-11-12 7:53 ` Sumit Garg [this message]
2025-11-12 7:53 ` Sumit Garg via OP-TEE
2025-11-14 8:50 ` Jens Wiklander
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aRQ9DQ1Ncf4Iep4o@sumit-X1 \
--to=sumit.garg@kernel.org \
--cc=allyheev@gmail.com \
--cc=amirreza.zarrabi@oss.qualcomm.com \
--cc=dan.carpenter@linaro.org \
--cc=jens.wiklander@linaro.org \
--cc=linux-arm-msm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=op-tee@lists.trustedfirmware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.