Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <140d1f43-d603-c24e-f72e-878ad10e751c@amd.com>
Date:   Thu, 17 Mar 2022 08:09:58 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.5.0
Subject: Re: [PATCH] drm/ttm: fix uninit ptr deref in range manager alloc
 error path
Content-Language: en-US
To:     Robert Beckett <bob.beckett@collabora.com>,
        dri-devel@lists.freedesktop.org, Huang Rui <ray.huang@amd.com>,
        David Airlie <airlied@linux.ie>,
        Daniel Vetter <daniel@ffwll.ch>
Cc:     Daniel Vetter <daniel.vetter@ffwll.ch>,
        linux-kernel@vger.kernel.org
References: <20220316195034.3821108-1-bob.beckett@collabora.com>
From:   =?UTF-8?Q?Christian_K=c3=b6nig?= <christian.koenig@amd.com>
In-Reply-To: <20220316195034.3821108-1-bob.beckett@collabora.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?TUh4OFNYYWRKUTdydmpIclpYMk00V2c4d3RaTnNNL1BENGF2TGhzNnJYMSsx?=
 =?utf-8?B?WVlXV3hUdVdHQ2lVcGRJYVZyMDdSNWtSODdURnF6UU0xRW9LOXJwT3JsbkJj?=
 =?utf-8?B?YnNjSFJvOFNXWUZwMFhOUFdhU25vRVRCMk1mSW5pckNKd3VmdE9xckx6L2ZV?=
 =?utf-8?B?MURXblp5b2VGTUdYNFNTdjJwbEU4OWhGWlE1WFY0eUFYUWJNTTJpMjdUYm5F?=
 =?utf-8?B?ZGVpSzltOFNvN294K3VrWnhpSjFXbFZwMTZyOEYrT25QbXc4VmNjN0M1cGJk?=
 =?utf-8?B?Um5PcFdpMzdGNTdEdG5sU2o3K2VEK0phN2ZjNGkvSW1TZE9oTG5BdXlTdlhG?=
 =?utf-8?B?ZVB0QWhDYTV4dnJ0OUNlYkZydmN2LzZtNWU3c2R6OVhXZGlNaVZjcllIMGlB?=
 =?utf-8?B?amJDb3h1VEk2ZVNrRnNlbExNZXFQYlIwTFVuN09ldmtvYmQ5VnVCTW93dVZZ?=
 =?utf-8?B?RkZrVWRGUzM1S2x4SzE4N3QwLytaeGp4NHBvM3FyRFN5K3pwYTlOMlA0Z2ZQ?=
 =?utf-8?B?Q2FRRHg3eGxhUjdpTmZGc1NBaWZuWG5xOVhSSXUyck92bExlcjJpRzgyQ2VY?=
 =?utf-8?B?TWgvUW5sN0VORXBlajIyY2QydG8rYnl3dS8wVmpPK1hMa05hZ3N0eEZ6dWtp?=
 =?utf-8?B?cnI4N0xpSGZSUDhjWk9aYUdiT05JK2Z5VlRyS05URXJnNkc3UWRtTERYZjEy?=
 =?utf-8?B?RFJoOWdCM2N5MlpYa1NiODBlaGluWDVueU4yQWRaRmU4a1dDNEpJcDhxaVdw?=
 =?utf-8?B?TGpLUkl6dUZrOTREM1J0SU80NHkwY2orTzQrbnZTY3YyUnZkUjRvTHRYU3RD?=
 =?utf-8?B?dW15empzWklSYjlpZllqOFJrMEQwZ3dIaTlQd2s1RlEvSkthS0pFbHhOKzV1?=
 =?utf-8?B?SXgxaGFONzBOVEwxRUdyOXZJVlc1c243R1NkTUszbGZwdnZkK2RRVjJyNFhC?=
 =?utf-8?B?d2wyMDFBSlo1QjVSbnZLZGpQQXZ3QVVRZFRuQ2sxNFdlTXFZYWZoYk4xc2RR?=
 =?utf-8?B?S1RTN0ZzWTlldUNYVG5yc3lLMDhleTR2OGlvbHhNNUR2bkYwaGF6L2crUFd0?=
 =?utf-8?B?SW4rM20vZVJ3VS9aaDVwTjUvbGhVTFNKN2MwemFrd3VPOGsyaStnMDNJYThP?=
 =?utf-8?B?TUlmRTRVaEhiK2xOZzJvZHVUckc1S3BoakVvdCt2VEN2M0pFSHZrTTh1bnFy?=
 =?utf-8?B?RzEwZEYyY3lFdnlIb0plVDBiR3VDc2pwclNkelgvbkpsZ0pabXFyWnVpbHlN?=
 =?utf-8?B?TDJFRnlGMHg2cjNQMVFyZEtmWi8zaFpZWDBMVUxDRTVpUFpxendoVFdsUkkx?=
 =?utf-8?B?NGl3RHBNSUVETVBrQTFCQXBqNFFpYlo1ejVnWnU5OUtQOENrVHRGd0djQjkw?=
 =?utf-8?B?b05wNzNtNW40eTd0L2FCc2VwOS9GZVNURTd5U2xoeVgzQXhiUCs0OERTcnJO?=
 =?utf-8?B?MzY1em96c0NKN2tXZVoxck5kNDArYVhyYmNjVlhZSmc3ZHk5elZaNmtNcnhz?=
 =?utf-8?B?K2l4MUdPdm8xcko3U0pWTndJZkdMMWtVVzU2ckdrTmVoOHBIaTJYWmRKWkhx?=
 =?utf-8?B?ZlR3ckpZYUFFdDZiRlBqTVpCRUNONzI2OFhIV1RGRWhVY2ZzVUQ2ZUlZV1NQ?=
 =?utf-8?B?Qm9yQ1F4TkswQm5uMDRmY2FBMkFybDJLQVFPRDBUeWRDYkNEVzNVQW8yQ3kr?=
 =?utf-8?B?YXRHTm1ycFdlN1NMMEtZbVdqM296NXBuMkxwTW41S1hnZG9aUGRNV2daS0M2?=
 =?utf-8?B?SnQvRDhFamYybzJyNGltWUlycmxYbk5JeExPOUtKd3NuVUdQNHBGRDhJVmRh?=
 =?utf-8?B?dGNFSy9VNEJRZGJyQ3hqTTYrTEZNTTZNdjNVVERzeHA3V21EUUdvL1NUdk1z?=
 =?utf-8?B?akFmSEhTVVhYeXlZUVpac2U4N2w3Y3RxU1hEeXJoNDJ2cVlhd29YcFVzc1Bm?=
 =?utf-8?Q?jGdP2Jo8F0BmQulwxYHXkK1hlhEsjxXq?=
X-OriginatorOrg: amd.com
X-MS-Exchange-CrossTenant-Network-Message-Id: f856f3fa-a378-43c1-f69f-08da07e52825
X-MS-Exchange-CrossTenant-AuthSource: BN8PR12MB3587.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Mar 2022 07:10:03.0859
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: TP42/H2CANJHqADLk2+UIh6t6wN89IbUGUPaYTe+MruAuftxmxDWRzFSZKRCQidZ
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR12MB1352
X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,NICE_REPLY_A,RCVD_IN_DNSWL_NONE,
        RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS,T_SCC_BODY_TEXT_LINE
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Am 16.03.22 um 20:50 schrieb Robert Beckett:
> ttm_range_man_alloc would try to ttm_resource_fini the res pointer
> before it is allocated.
>
> Fixes: de3688e469b0 (drm/ttm: add ttm_resource_fini v2)
>
> Signed-off-by: Robert Beckett <bob.beckett@collabora.com>

Reviewed-by: Christian König <christian.koenig@amd.com>

Good catch, going to push that to drm-misc-fixes.

> ---
>   drivers/gpu/drm/ttm/ttm_range_manager.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/ttm/ttm_range_manager.c b/drivers/gpu/drm/ttm/ttm_range_manager.c
> index 5662627bb933..1b4d8ca52f68 100644
> --- a/drivers/gpu/drm/ttm/ttm_range_manager.c
> +++ b/drivers/gpu/drm/ttm/ttm_range_manager.c
> @@ -89,7 +89,7 @@ static int ttm_range_man_alloc(struct ttm_resource_manager *man,
>   	spin_unlock(&rman->lock);
>   
>   	if (unlikely(ret)) {
> -		ttm_resource_fini(man, *res);
> +		ttm_resource_fini(man, &node->base);
>   		kfree(node);
>   		return ret;
>   	}