Received: by 2002:a05:6a10:413:0:0:0:0 with SMTP id 19csp936064pxp; Wed, 16 Mar 2022 21:54:14 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwdROKwDjPxnDwN/DPYkgLzs8iUJ0aarg3CtbgHw913t9tY6e44UtGLbgQ4SUmCxGSylJiR X-Received: by 2002:a05:6a00:139e:b0:4f7:1576:f8fb with SMTP id t30-20020a056a00139e00b004f71576f8fbmr2835469pfg.85.1647492854539; Wed, 16 Mar 2022 21:54:14 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1647492854; cv=none; d=google.com; s=arc-20160816; b=Gpx4HPGFYqPS2mcGUSs5pKSQjZeb6h0gBf5mQqtywtW+TtPMRmQYzobYsQDhM7dpSr Qt3CYonMHZijX3Wyv201CYgSHicaDHFLgpRosp2jlZ+s4saKXj4+0hKGNzK+TGTJVEPh K7gemCG9b3Ge5NDaA4H+RCERbSrJs0Re6BzjaDyDjqyeQfWfpm2oLlC6/Bki8ojFyAZM qs0YV+myMsSBsvwNrIRYJaqtpChpjE4qUH7eyCw+DRS0VJfF/l1e5Ipzr3BO7jmbRyA6 DsinVw/OWCq+CJxreAIEBVLMJrLhiDzwlp0Movy+HiQyCnw0hZnpMUaizpYG9HEC/UeP DN4A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=+nmHhQAAX2bEh6orCqpV0TJuF0WYkYr4h4EfCPbmN/I=; b=KcS3bhLZAufESKqaED0lVHBDTv3eAZMhXBoU9pd02wdI11p9wWxUJEFpf/g1nGKKKT LKo9DEmL0CE7OHZkwdj8vbtFvP6UOBLijM3hN55ELf7C18BDX5/Xdwm9rQIBR2IRttZm iQbupt/EKB1bHiyqZgtQDTmSJ/CoN8UdJkjTiGbsgJYP6mdKPTiEmoGO709+pNKZbUnI nQJsj7wTB4N1Rilsa5Bg2bVSZ3bYOzWDcKbh0c2hOetmx3OTf1YqDIShZbnEWDqoP9iS uRxaFJH7YX0WDCy6qm3a36htEE9pSqk3tYT/c8q22KIYmkf0goAkoBEwiUBTwp1k9C/F bKPg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@collabora.com header.s=mail header.b=ZC6yeoP0; spf=softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=collabora.com Return-Path: Received: from lindbergh.monkeyblade.net (lindbergh.monkeyblade.net. [23.128.96.19]) by mx.google.com with ESMTPS id g14-20020a63200e000000b003816043f10dsi997973pgg.770.2022.03.16.21.54.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 16 Mar 2022 21:54:14 -0700 (PDT) Received-SPF: softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) client-ip=23.128.96.19; Authentication-Results: mx.google.com; dkim=pass header.i=@collabora.com header.s=mail header.b=ZC6yeoP0; spf=softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=collabora.com Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 8A320B0A66; Wed, 16 Mar 2022 21:12:11 -0700 (PDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343882AbiCPTwI (ORCPT + 99 others); Wed, 16 Mar 2022 15:52:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46474 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237645AbiCPTwG (ORCPT ); Wed, 16 Mar 2022 15:52:06 -0400 Received: from bhuna.collabora.co.uk (bhuna.collabora.co.uk [IPv6:2a00:1098:0:82:1000:25:2eeb:e3e3]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4DA5A5AEFD for ; Wed, 16 Mar 2022 12:50:52 -0700 (PDT) Received: from [127.0.0.1] (localhost [127.0.0.1]) (Authenticated sender: bbeckett) with ESMTPSA id 237E61F42B7C DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1647460250; bh=2X9h3nK80lcnPb4NphKM5EwYM/7VFhDpWrcrESua5VM=; h=From:To:Cc:Subject:Date:From; b=ZC6yeoP0u5YljDKXBUmjhxMwqmEBdz/dwjVonSXoti8So2CArj1FC7/edEN2RaPaB 3hl8lpKvTdcwzHyfr+eQaMcXIl2vtxsVuMBG9WKHUY/gyiapr9QjEpphtS+yiRPX8W nQri+T0ePsWuGCh3B1/2HX9zL8RzdqAQ1rYYF8TPWHcAujwhBHMj2V7wlOYxd2LuwN 6wvLb+TjFm3QZNMwXliu+c8izhMjGjL9KZcZozlyxOY/5rhSHroylr+pOachUguNfh HRmwRjpzENPc9JDKc31k2ozTID8brXVm2HkA0dYA0jDQhTD7LHen5xs8CcfSZewgtt n3l0FfYyb+N1w== From: Robert Beckett To: dri-devel@lists.freedesktop.org, Christian Koenig , Huang Rui , David Airlie , Daniel Vetter Cc: Robert Beckett , Daniel Vetter , linux-kernel@vger.kernel.org Subject: [PATCH] drm/ttm: fix uninit ptr deref in range manager alloc error path Date: Wed, 16 Mar 2022 19:50:34 +0000 Message-Id: <20220316195034.3821108-1-bob.beckett@collabora.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RDNS_NONE,SPF_HELO_NONE,T_SCC_BODY_TEXT_LINE, UNPARSEABLE_RELAY autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org ttm_range_man_alloc would try to ttm_resource_fini the res pointer before it is allocated. Fixes: de3688e469b0 (drm/ttm: add ttm_resource_fini v2) Signed-off-by: Robert Beckett --- drivers/gpu/drm/ttm/ttm_range_manager.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/ttm/ttm_range_manager.c b/drivers/gpu/drm/ttm/ttm_range_manager.c index 5662627bb933..1b4d8ca52f68 100644 --- a/drivers/gpu/drm/ttm/ttm_range_manager.c +++ b/drivers/gpu/drm/ttm/ttm_range_manager.c @@ -89,7 +89,7 @@ static int ttm_range_man_alloc(struct ttm_resource_manager *man, spin_unlock(&rman->lock); if (unlikely(ret)) { - ttm_resource_fini(man, *res); + ttm_resource_fini(man, &node->base); kfree(node); return ret; } -- 2.25.1