Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <fc9d282d-e1ac-b99f-7ba0-77bb9c52cca4@amd.com>
Date:   Mon, 17 Apr 2023 16:42:30 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.10.0
Subject: Re: [PATCH] drm/ttm: fix null-ptr-deref in radeon_ttm_tt_populate()
Content-Language: en-US
To:     Nikita Zhandarovich <n.zhandarovich@fintech.ru>,
        Alex Deucher <alexander.deucher@amd.com>
Cc:     "Pan, Xinhui" <Xinhui.Pan@amd.com>,
        David Airlie <airlied@gmail.com>,
        Daniel Vetter <daniel@ffwll.ch>,
        Jerome Glisse <jglisse@redhat.com>,
        amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org,
        linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org
References: <20230417143431.58858-1-n.zhandarovich@fintech.ru>
From:   =?UTF-8?Q?Christian_K=c3=b6nig?= <christian.koenig@amd.com>
In-Reply-To: <20230417143431.58858-1-n.zhandarovich@fintech.ru>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?Mzl4c1NYYm16cVJXMHdiWmdXUisrMllURHc2MlNGcTA3UWpXb1Zkd2VuVVVY?=
 =?utf-8?B?bmdCb0JDQmF0YmlTd3NWdUNWNjlrTWNUTlhVTzFteGplc0VwVmtqNUs4QlVk?=
 =?utf-8?B?bGJseWVQTlNUZGF3c3VvWlYrWW9HV3hZcW1QY001NUUwUDNWY1VUajBUUXhO?=
 =?utf-8?B?UWYwR0ZiYXM1TVl4N256YXJSZTNLMzV2a1NlSTRtUHA0WHFzMHRicjlTTTNx?=
 =?utf-8?B?TDEraTUxanRMYUpOT3dJVnpBUVd1NUw0SWtsYzI4ZEwwcjNSQnp5aXVBTG5M?=
 =?utf-8?B?VEVDc0FFZnNnamlFY1dIcWU2Rm9ERk90TTRTM0NtM05zNW1CNGVvZkl3UnFE?=
 =?utf-8?B?OFd4eStpellnRjVsQmQ1bnpKaDdFU0U2RXZlMzkvRXRCamlFdEw5eUg3NUFw?=
 =?utf-8?B?NjF6a2djT2oxVjkxWXAzdnVyd0NKVEFxY3YveTJwVEkvalMvUjVCRnJNeGEr?=
 =?utf-8?B?aXBLcFZIemRBWXNpcVJHTUFMa3RBNHZzSU9aMy9PZXM1dFJjNEttQVg0bTV1?=
 =?utf-8?B?VnE0VzhnQnFJdVF2ZzdpV1ZQMHZwa1BTNVNxNzJXVkNJUHpQWjZPTy8vMGgz?=
 =?utf-8?B?NW9sU2twUGUvZVVsZHRuOCtkZm9UMFR2MGYzYk0rK01JYm1LaTc0SUJXbTlF?=
 =?utf-8?B?WUN4czYrbEM4ZUxqdVFETU14K2Fna2czQUFIOEI2V2JNTDVZYW9ya2ovVDhQ?=
 =?utf-8?B?TTdJUUZ3aEU2SEFRa0hnU2kzMTF0anpzL2ppYktpdnRFZUdIK0dXOWlDanBP?=
 =?utf-8?B?eXcvSXhIYWNEMGxIRTlOYi9vTkltVXB4bGExcHFFMlZaT3lEN2F4TlhhdGZ3?=
 =?utf-8?B?ekRWTEx0cXJFQ082UWVDbG42djR6V0lKZUJOcHNrSEN5Q0dpZDBLWFBBM0tD?=
 =?utf-8?B?OGU2eHVPTGxKL0dJT3liMWdqM0FUOTZjZ291Vjd5UWtUQmtScW5NSHRoSVFI?=
 =?utf-8?B?cnJRWXNITlJyckp0UmhhTWp6T1NVYW4rSmdub211YjZLN01MNW80b1JBdWlZ?=
 =?utf-8?B?Vzh4b1RxMjhXY09peW11N0NYcDB1cHFuUHM5YkZNYXFaajFMNWVCSWlsM01G?=
 =?utf-8?B?V1MzMDYyRUdoUm9YZlNiT1g2M1BKVmdUM0RxVkZ4QjJnTXNVU3IzVWVkZVZ4?=
 =?utf-8?B?bWM0RFhsMm52elkrTm41aHZkTHpnbHBxWmlkS1FRQytFdi9sSjZZVlNIbUpY?=
 =?utf-8?B?VEQyK3JkMWlKQVdBSGhzVVZibTlrcUZFcG85YVpvTjE0Qmp1NHc2akl4U29l?=
 =?utf-8?B?YlQxVFJPcmg1NlA0VFJwbHhDSVY3TWpRVE1FN1U4dFJ5LzcvTW5aaHNUeXBt?=
 =?utf-8?B?eTVEd09ETzdPK0JMUTJadDIzL1VncjRzNW1IYWVIWmE0WkVaSzBPUFZDRkN5?=
 =?utf-8?B?UVpISDRSWHZPYVJqRS9UazlYRW51Tml0d0xpbXVqRWdzN3RtZk11YzlZYmo2?=
 =?utf-8?B?RUtrdlRObEZDZmQ3YU1TVHowT3gwWG9jdFAwa3VWR0FnL3FPVVFVL3kycHdX?=
 =?utf-8?B?K0QyMExhdXBnUk9rQ1dhR1lRQnZnVjMyaGR1dGhMcy9kUVBaWkpDMmJiOEt1?=
 =?utf-8?B?Unk3VHRDNC9pUzk5T3FOVWpqdlV5YzRmY1FEZndQTU9mU29NLzNVMXRLUG9k?=
 =?utf-8?B?V3VKYXBBZTRsbzhxYzdFK2pKS29OUzVVTDJCMTFvSitsWkNuamRVLzNRT0NJ?=
 =?utf-8?B?R1Noa3BmandTMUNQWERYK0JwVy9ENjY5d2NabTI0VG0zeXhNdVJMaW1zaTd3?=
 =?utf-8?B?UFlGeFZLN3hxLzAzMWRjdmIzMVJzcmpIc2lYbERMME1ydmdsMDAzYlJSWTZW?=
 =?utf-8?B?eEo0RXU4UVBzcWIxMGw1QXlOaDEyNUt6NnluVXNMTFRCd1RKYjAzUDJoeUJn?=
 =?utf-8?B?dnBxRWdMMDRQWGtJYkp0VUUzdnJMcEkwbG5ZU09wTHZQdHZ0NVk2ZFE5T1FU?=
 =?utf-8?B?M1NxK2laRmRDcTRBUzVDbVF2SFZJeldsVlFNNk9WMkZISTN2K1lkRi95SEFj?=
 =?utf-8?B?SVVTUTBMdWRoSndSN0QwKzRNbE5SYVAwY2xEQzdBL3NDeVk3UmtGZkQxdE11?=
 =?utf-8?B?YUVyZkFJZUwyK1FESyszU21hZHhBQU1aaGZxa3huVEtJVUV0cGpBT2h0cklB?=
 =?utf-8?B?dFBrWisxWGUwLzNwZm1xUXJVZ1ZGekM5ZEo1Z3hEVTRxWDdmY2hUQzlXVjRa?=
 =?utf-8?Q?V7/f2Ac+mGBtsFzqJXyQnp95vue0W18Z8xenXX515M27?=
X-OriginatorOrg: amd.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 7b302cf7-91ee-4fa0-610c-08db3f51fbeb
X-MS-Exchange-CrossTenant-AuthSource: BN8PR12MB3587.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Apr 2023 14:42:35.7317
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: h8fFrRSxmH2JMhVyaaMGZrkWG4q4BX+xNlncbkfybA1FHlmFmW5GUE+7K45jCx4/
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW6PR12MB8759
X-Spam-Status: No, score=-3.4 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FORGED_SPF_HELO,NICE_REPLY_A,
        RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_NONE,
        T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


Am 17.04.23 um 16:34 schrieb Nikita Zhandarovich:
> Currently, drm_prime_sg_to_page_addr_arrays() dereferences 'gtt->ttm'
> without ensuring that 'gtt' (and therefore 'gtt->tmm') is not NULL.
>
> Fix this by testing 'gtt' for NULL value before dereferencing.
>
> Found by Linux Verification Center (linuxtesting.org) with static
> analysis tool SVACE.
>
> Fixes: 40f5cf996991 ("drm/radeon: add PRIME support (v2)")
> Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
> ---
>   drivers/gpu/drm/radeon/radeon_ttm.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
> index 1e8e287e113c..33d01c3bdee4 100644
> --- a/drivers/gpu/drm/radeon/radeon_ttm.c
> +++ b/drivers/gpu/drm/radeon/radeon_ttm.c
> @@ -553,7 +553,7 @@ static int radeon_ttm_tt_populate(struct ttm_device *bdev,
>   		return 0;
>   	}
>   
> -	if (slave && ttm->sg) {
> +	if (gtt && slave && ttm->sg) {

The gtt variable is derived from the ttm variable and so never NULL 
here. The only case when this can be NULL is for AGP and IIRC we don't 
support DMA-buf in this case.

>   		drm_prime_sg_to_dma_addr_array(ttm->sg, gtt->ttm.dma_address,

Just use ttm->dma_addresses instead of gtt->ttm.dma_address here to make 
your automated checker happy.

Regards,
Christian.

>   					       ttm->num_pages);
>   		return 0;