Skip to contentSkip to conversation

drm/ttm/tests: fix potential null pointer dereference in ttm_bo_unreserve_bulk()

PATCH In review Qasim Ijaz 2 participants 2 messages Mar 11, 2025 – Mar 13, 2025

Subsystems (4)
Stable branch DRM drivers DRM misc DRM TTM
lore
Share & tools
lore

Qasim Ijaz

author
#0 lore raw

PATCH 1/1 drm/ttm/tests: fix potential null pointer dereference in ttm_bo_unreserve_bulk()

In the ttm_bo_unreserve_bulk() test function, resv is allocated using kunit_kzalloc(), but the subsequent assertion mistakenly verifies the ttm_dev pointer instead of checking the resv pointer. This mistake means that if allocation for resv fails, the error will go undetected, resv will be NULL and a call to dma_resv_init(resv) will dereference a NULL pointer.

Fix the assertion to properly verify the resv pointer.

Fixes 588c4c8d58c4 ("drm/ttm/tests: Fix a warning in ttm_bo_unreserve_bulk")
Cc [email protected]
Signed-off-by Qasim Ijaz <[email protected]>
---
 drivers/gpu/drm/ttm/tests/ttm_bo_test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/ttm/tests/ttm_bo_test.c +1 -1
index f8f20d2f6174..e08e5a138420 100644
@@ -340,7 +340,7 @@ static void ttm_bo_unreserve_bulk(struct kunit *test)
 	KUNIT_ASSERT_NOT_NULL(test, ttm_dev);
 
 	resv = kunit_kzalloc(test, sizeof(*resv), GFP_KERNEL);
-	KUNIT_ASSERT_NOT_NULL(test, ttm_dev);
+	KUNIT_ASSERT_NOT_NULL(test, resv);
 
 	err = ttm_device_kunit_init(priv, ttm_dev, false, false);
 	KUNIT_ASSERT_EQ(test, err, 0);
Signature · 1 line
2.39.5
#1 lore raw

Am 11.03.25 um 20:01 schrieb Qasim Ijaz:

Quoted 5 lines

In the ttm_bo_unreserve_bulk() test function, resv is allocated using kunit_kzalloc(), but the subsequent assertion mistakenly verifies the ttm_dev pointer instead of checking the resv pointer. This mistake means that if allocation for resv fails, the error will go undetected, resv will be NULL and a call to dma_resv_init(resv)

The description here is correct, but the subject line is a bit misleading.

Please use something like this instead "drm/ttm/tests: incorrect assert in ttm_bo_unreserve_bulk()".

Quoted 1 line

will dereference a NULL pointer.

That irrelevant, an allocation failure will result in a NULL pointer deref anyway. This is just an unit test.

Quoted 5 lines

Fix the assertion to properly verify the resv pointer.

Fixes 588c4c8d58c4 ("drm/ttm/tests: Fix a warning in ttm_bo_unreserve_bulk")
Cc [email protected]

Please drop those tags. This is just an unit test, not relevant for stability and therefore shouldn't be backported.

Regards,
Christian.

Quoted 18 lines
Signed-off-by Qasim Ijaz <[email protected]>
---
 drivers/gpu/drm/ttm/tests/ttm_bo_test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/ttm/tests/ttm_bo_test.c +1 -1
index f8f20d2f6174..e08e5a138420 100644
@@ -340,7 +340,7 @@ static void ttm_bo_unreserve_bulk(struct kunit *test)
 	KUNIT_ASSERT_NOT_NULL(test, ttm_dev);
 
 	resv = kunit_kzalloc(test, sizeof(*resv), GFP_KERNEL);
-	KUNIT_ASSERT_NOT_NULL(test, ttm_dev);
+	KUNIT_ASSERT_NOT_NULL(test, resv);
 
 	err = ttm_device_kunit_init(priv, ttm_dev, false, false);
 	KUNIT_ASSERT_EQ(test, err, 0);