All the mail mirrored from lore.kernel.org
 help / color / mirror / Atom feed
From: "Christian König" <christian.koenig@amd.com>
To: Arunpravin Paneer Selvam <arunpravin.paneerselvam@amd.com>,
	Dan Carpenter <dan.carpenter@oracle.com>
Cc: dri-devel@lists.freedesktop.org
Subject: Re: [bug report] drm/ttm: Fix dummy res NULL ptr deref bug
Date: Sun, 14 Aug 2022 19:50:26 +0200	[thread overview]
Message-ID: <35ff4c21-c305-6fda-f54e-1f9a141c5879@amd.com> (raw)
In-Reply-To: <9433a0ee-ef19-86d4-e4fd-8ccff53ff5a7@amd.com>

Am 14.08.22 um 08:00 schrieb Arunpravin Paneer Selvam:
> Hi Dan,
>
> On 8/11/2022 5:26 PM, Dan Carpenter wrote:
>> On Thu, Aug 11, 2022 at 04:36:33PM +0530, Arunpravin Paneer Selvam 
>> wrote:
>>> Hi Dan,
>>>
>>> drm-misc-fixes doesn't have the updated ttm_bo.c file, we have the 
>>> updated
>>> ttm_bo.c version in
>>> drm-misc-next branch. Please find below for the line number 907.
>>>
>>> On 8/11/2022 3:25 PM, Dan Carpenter wrote:
>>>> Hello Arunpravin Paneer Selvam,
>>>>
>>>> This is a semi-automatic email about new static checker warnings.
>>>>
>>>> The patch cf4b7387c0a8: "drm/ttm: Fix dummy res NULL ptr deref bug"
>>>> from Aug 9, 2022, leads to the following Smatch complaint:
>>>>
>>>>       drivers/gpu/drm/ttm/ttm_bo.c:915 ttm_bo_validate()
>>>>       warn: variable dereferenced before check 'bo->resource' (see 
>>>> line 907)
>>>>
>>>> drivers/gpu/drm/ttm/ttm_bo.c
>>>>      906         */
>>>>      907        if (!ttm_resource_compat(bo->resource, placement)) {
>>>>                                            ^^^^^^^^^^^^
>>>> Unchecked dereference here inside the function.
>>> |if (!bo->resource || !ttm_resource_compat(bo->resource, placement)) 
>>> { we
>>> have this version in drm-misc-next Regards, Arun |
>>>
>> Huh...  That's very interesting.  It appears there was a bug in
>> drm-misc-next, we applied the fix to the wrong tree, and now both trees
>> are wrong.  The drm-misc-next tree still has the bug and the other tree
>> has a static checker warning about nonsensical NULL checks.
>>
>> Eventually drm-misc-next will get merged and everything will work.  Is
>> it too late to remove the bogus "CC: stable@vger.kernel.org"?
> I will look into this problem.

Mhm, if I'm not completely mistaken the "CC: stable@vger.kernel.org" is 
actually correct, we just need to limit to which version it applies.

>> This could have been avoided if the NULL dereference fix had a Fixes 
>> tag.
> I should have added the below tag
> Fixes: 347987a2cf0d ("drm/ttm: rename and cleanup ttm_bo_init")

WAIT! That's not the correct one. This patch just made the problem more 
obvious.

The real one is bfa3357ef9ab drm/ttm: allocate resource object instead 
of embedding it v2

Regards,
Christian.

>
> I will check on this.
>
> Thanks,
> Arun
>>
>> regards,
>> dan carpenter
>>
>


      reply	other threads:[~2022-08-14 17:50 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-08-11  9:55 [bug report] drm/ttm: Fix dummy res NULL ptr deref bug Dan Carpenter
2022-08-11 11:06 ` Arunpravin Paneer Selvam
2022-08-11 11:56   ` Dan Carpenter
2022-08-14  6:00     ` Arunpravin Paneer Selvam
2022-08-14 17:50       ` Christian König [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=35ff4c21-c305-6fda-f54e-1f9a141c5879@amd.com \
    --to=christian.koenig@amd.com \
    --cc=arunpravin.paneerselvam@amd.com \
    --cc=dan.carpenter@oracle.com \
    --cc=dri-devel@lists.freedesktop.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.