Re: [PATCH] drm/ttm/tests: fix potential null pointer dereference in ttm_bo_unreserve_bulk()

Re: [PATCH] drm/ttm/tests: fix potential null pointer dereference in ttm_bo_unreserve_bulk()

[Qasim Ijaz]

On Thu, Mar 13, 2025 at 03:20:34PM +0100, Christian König wrote:
> Am 11.03.25 um 20:01 schrieb Qasim Ijaz:
> > In the ttm_bo_unreserve_bulk() test function, resv is allocated 
> > using kunit_kzalloc(), but the subsequent assertion mistakenly 
> > verifies the ttm_dev pointer instead of checking the resv pointer. 
> > This mistake means that if allocation for resv fails, the error will 
> > go undetected, resv will be NULL and a call to dma_resv_init(resv) 
> 
> The description here is correct, but the subject line is a bit misleading.
> 
> Please use something like this instead "drm/ttm/tests: incorrect assert in ttm_bo_unreserve_bulk()".
> 
> > will dereference a NULL pointer. 
> 
> That irrelevant, an allocation failure will result in a NULL pointer deref anyway. This is just an unit test.
> 
> >
> > Fix the assertion to properly verify the resv pointer.
> >
> > Fixes: 588c4c8d58c4 ("drm/ttm/tests: Fix a warning in ttm_bo_unreserve_bulk")
> > Cc: stable@vger.kernel.org
> 
> Please drop those tags. This is just an unit test, not relevant for stability and therefore shouldn't be backported.
> 
> Regards,
> Christian.
> 
Thank you for the feedback Christian, I will resend a new patch with the
changes you described.

Thanks,
Qasim.
> > Signed-off-by: Qasim Ijaz <qasdev00@gmail.com>
> > ---
> >  drivers/gpu/drm/ttm/tests/ttm_bo_test.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/gpu/drm/ttm/tests/ttm_bo_test.c b/drivers/gpu/drm/ttm/tests/ttm_bo_test.c
> > index f8f20d2f6174..e08e5a138420 100644
> > --- a/drivers/gpu/drm/ttm/tests/ttm_bo_test.c
> > +++ b/drivers/gpu/drm/ttm/tests/ttm_bo_test.c
> > @@ -340,7 +340,7 @@ static void ttm_bo_unreserve_bulk(struct kunit *test)
> >  	KUNIT_ASSERT_NOT_NULL(test, ttm_dev);
> >  
> >  	resv = kunit_kzalloc(test, sizeof(*resv), GFP_KERNEL);
> > -	KUNIT_ASSERT_NOT_NULL(test, ttm_dev);
> > +	KUNIT_ASSERT_NOT_NULL(test, resv);
> >  
> >  	err = ttm_device_kunit_init(priv, ttm_dev, false, false);
> >  	KUNIT_ASSERT_EQ(test, err, 0);
> 

[PATCH] drm/ttm/tests: fix potential null pointer dereference in ttm_bo_unreserve_bulk()

[Qasim Ijaz]

In the ttm_bo_unreserve_bulk() test function, resv is allocated 
using kunit_kzalloc(), but the subsequent assertion mistakenly 
verifies the ttm_dev pointer instead of checking the resv pointer. 
This mistake means that if allocation for resv fails, the error will 
go undetected, resv will be NULL and a call to dma_resv_init(resv) 
will dereference a NULL pointer. 

Fix the assertion to properly verify the resv pointer.

Fixes: 588c4c8d58c4 ("drm/ttm/tests: Fix a warning in ttm_bo_unreserve_bulk")
Cc: stable@vger.kernel.org
Signed-off-by: Qasim Ijaz <qasdev00@gmail.com>
---
 drivers/gpu/drm/ttm/tests/ttm_bo_test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/ttm/tests/ttm_bo_test.c b/drivers/gpu/drm/ttm/tests/ttm_bo_test.c
index f8f20d2f6174..e08e5a138420 100644
--- a/drivers/gpu/drm/ttm/tests/ttm_bo_test.c
+++ b/drivers/gpu/drm/ttm/tests/ttm_bo_test.c
@@ -340,7 +340,7 @@ static void ttm_bo_unreserve_bulk(struct kunit *test)
 	KUNIT_ASSERT_NOT_NULL(test, ttm_dev);
 
 	resv = kunit_kzalloc(test, sizeof(*resv), GFP_KERNEL);
-	KUNIT_ASSERT_NOT_NULL(test, ttm_dev);
+	KUNIT_ASSERT_NOT_NULL(test, resv);
 
 	err = ttm_device_kunit_init(priv, ttm_dev, false, false);
 	KUNIT_ASSERT_EQ(test, err, 0);
-- 
2.39.5

Re: [PATCH] drm/ttm/tests: fix potential null pointer dereference in ttm_bo_unreserve_bulk()

[Christian König]

Am 11.03.25 um 20:01 schrieb Qasim Ijaz:
> In the ttm_bo_unreserve_bulk() test function, resv is allocated 
> using kunit_kzalloc(), but the subsequent assertion mistakenly 
> verifies the ttm_dev pointer instead of checking the resv pointer. 
> This mistake means that if allocation for resv fails, the error will 
> go undetected, resv will be NULL and a call to dma_resv_init(resv) 

The description here is correct, but the subject line is a bit misleading.

Please use something like this instead "drm/ttm/tests: incorrect assert in ttm_bo_unreserve_bulk()".

> will dereference a NULL pointer. 

That irrelevant, an allocation failure will result in a NULL pointer deref anyway. This is just an unit test.

>
> Fix the assertion to properly verify the resv pointer.
>
> Fixes: 588c4c8d58c4 ("drm/ttm/tests: Fix a warning in ttm_bo_unreserve_bulk")
> Cc: stable@vger.kernel.org

Please drop those tags. This is just an unit test, not relevant for stability and therefore shouldn't be backported.

Regards,
Christian.

> Signed-off-by: Qasim Ijaz <qasdev00@gmail.com>
> ---
>  drivers/gpu/drm/ttm/tests/ttm_bo_test.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/ttm/tests/ttm_bo_test.c b/drivers/gpu/drm/ttm/tests/ttm_bo_test.c
> index f8f20d2f6174..e08e5a138420 100644
> --- a/drivers/gpu/drm/ttm/tests/ttm_bo_test.c
> +++ b/drivers/gpu/drm/ttm/tests/ttm_bo_test.c
> @@ -340,7 +340,7 @@ static void ttm_bo_unreserve_bulk(struct kunit *test)
>  	KUNIT_ASSERT_NOT_NULL(test, ttm_dev);
>  
>  	resv = kunit_kzalloc(test, sizeof(*resv), GFP_KERNEL);
> -	KUNIT_ASSERT_NOT_NULL(test, ttm_dev);
> +	KUNIT_ASSERT_NOT_NULL(test, resv);
>  
>  	err = ttm_device_kunit_init(priv, ttm_dev, false, false);
>  	KUNIT_ASSERT_EQ(test, err, 0);