2019-10-10 05:11:37

by Yizhuo Zhai

Subject: Potential NULL pointer deference in drm/amdgpu

Hi All:
drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c:
The function to_amdgpu_fence() could return NULL, but callers
in this file does not check the return value but directly dereference it,
which seems potentially unsafe.
Such callers include amdgpu_fence_get_timeline_name(),
amdgpu_fence_enable_signaling() and amdgpu_fence_free().


--
Kind Regards,

Yizhuo Zhai

Computer Science, Graduate Student
University of California, Riverside

2019-10-10 06:53:43

by Christian König

Subject: Re: Potential NULL pointer deference in drm/amdgpu

Hi Yizhuo,

Am 10.10.19 um 07:09 schrieb Yizhuo Zhai:
> Hi All:
> drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c:
> The function to_amdgpu_fence() could return NULL, but callers
> in this file does not check the return value but directly dereference it,
> which seems potentially unsafe.
> Such callers include amdgpu_fence_get_timeline_name(),
> amdgpu_fence_enable_signaling() and amdgpu_fence_free().

That is expected behavior and no need to worry.

The functions in amdgpu_fence.c are the callbacks to implement
amdgpu_fence_ops. The function to_amdgpu_fence() checks if the ops of
the fence are amdgpu_fence_ops, so it is guaranteed that the functions
are called with an amdgpu_fence structure.

Regards,
Christian.