Re: [PATCH] drm/ttm/tests: fix potential null pointer dereference in ttm_bo_unreserve_bulk()

[Christian König]

Am 11.03.25 um 20:01 schrieb Qasim Ijaz:
> In the ttm_bo_unreserve_bulk() test function, resv is allocated 
> using kunit_kzalloc(), but the subsequent assertion mistakenly 
> verifies the ttm_dev pointer instead of checking the resv pointer. 
> This mistake means that if allocation for resv fails, the error will 
> go undetected, resv will be NULL and a call to dma_resv_init(resv) 

The description here is correct, but the subject line is a bit misleading.

Please use something like this instead "drm/ttm/tests: incorrect assert in ttm_bo_unreserve_bulk()".

> will dereference a NULL pointer. 

That irrelevant, an allocation failure will result in a NULL pointer deref anyway. This is just an unit test.

>
> Fix the assertion to properly verify the resv pointer.
>
> Fixes: 588c4c8d58c4 ("drm/ttm/tests: Fix a warning in ttm_bo_unreserve_bulk")
> Cc: stable@xxxxxxxxxxxxxxx

Please drop those tags. This is just an unit test, not relevant for stability and therefore shouldn't be backported.

Regards,
Christian.

> Signed-off-by: Qasim Ijaz <qasdev00@xxxxxxxxx>
> ---
>  drivers/gpu/drm/ttm/tests/ttm_bo_test.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/ttm/tests/ttm_bo_test.c b/drivers/gpu/drm/ttm/tests/ttm_bo_test.c
> index f8f20d2f6174..e08e5a138420 100644
> --- a/drivers/gpu/drm/ttm/tests/ttm_bo_test.c
> +++ b/drivers/gpu/drm/ttm/tests/ttm_bo_test.c
> @@ -340,7 +340,7 @@ static void ttm_bo_unreserve_bulk(struct kunit *test)
>  	KUNIT_ASSERT_NOT_NULL(test, ttm_dev);
>  
>  	resv = kunit_kzalloc(test, sizeof(*resv), GFP_KERNEL);
> -	KUNIT_ASSERT_NOT_NULL(test, ttm_dev);
> +	KUNIT_ASSERT_NOT_NULL(test, resv);
>  
>  	err = ttm_device_kunit_init(priv, ttm_dev, false, false);
>  	KUNIT_ASSERT_EQ(test, err, 0);