Yizhuo Zhai
2021-Dec-18 02:56 UTC
[Nouveau] [PATCH] drm/nouveau/core/object: Fix the uninitialized use of "type"
In function nvkm_ioctl_map(), the variable "type" could be
uninitialized if "nvkm_object_map()" returns error code, however,
it does not check the return value and directly use the "type" in
the if statement, which is potentially unsafe.
Cc: stable at vger.kernel.org
Fixes: 01326050391c ("drm/nouveau/core/object: allow arguments to be passed
to map function")
Signed-off-by: Yizhuo Zhai <yzhai003 at ucr.edu>
---
drivers/gpu/drm/nouveau/nvkm/core/ioctl.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/nouveau/nvkm/core/ioctl.c
b/drivers/gpu/drm/nouveau/nvkm/core/ioctl.c
index 735cb6816f10..4264d9d79783 100644
--- a/drivers/gpu/drm/nouveau/nvkm/core/ioctl.c
+++ b/drivers/gpu/drm/nouveau/nvkm/core/ioctl.c
@@ -266,6 +266,8 @@ nvkm_ioctl_map(struct nvkm_client *client,
ret = nvkm_object_map(object, data, size, &type,
&args->v0.handle,
&args->v0.length);
+ if (ret)
+ return ret;
if (type == NVKM_OBJECT_MAP_IO)
args->v0.type = NVIF_IOCTL_MAP_V0_IO;
else
--
2.25.1
Lyude Paul
2022-Jan-11 18:11 UTC
[Nouveau] [PATCH] drm/nouveau/core/object: Fix the uninitialized use of "type"
Reviewed-by: Lyude Paul <lyude at redhat.com> On Fri, 2021-12-17 at 18:56 -0800, Yizhuo Zhai wrote:> In function nvkm_ioctl_map(), the variable "type" could be > uninitialized if "nvkm_object_map()" returns error code, however, > it does not check the return value and directly use the "type" in > the if statement, which is potentially unsafe. > > Cc: stable at vger.kernel.org > Fixes: 01326050391c ("drm/nouveau/core/object: allow arguments to be passed > to map function") > Signed-off-by: Yizhuo Zhai <yzhai003 at ucr.edu> > --- > ?drivers/gpu/drm/nouveau/nvkm/core/ioctl.c | 2 ++ > ?1 file changed, 2 insertions(+) > > diff --git a/drivers/gpu/drm/nouveau/nvkm/core/ioctl.c > b/drivers/gpu/drm/nouveau/nvkm/core/ioctl.c > index 735cb6816f10..4264d9d79783 100644 > --- a/drivers/gpu/drm/nouveau/nvkm/core/ioctl.c > +++ b/drivers/gpu/drm/nouveau/nvkm/core/ioctl.c > @@ -266,6 +266,8 @@ nvkm_ioctl_map(struct nvkm_client *client, > ????????????????ret = nvkm_object_map(object, data, size, &type, > ????????????????????????????????????? &args->v0.handle, > ????????????????????????????????????? &args->v0.length); > +???????????????if (ret) > +???????????????????????return ret; > ????????????????if (type == NVKM_OBJECT_MAP_IO) > ????????????????????????args->v0.type = NVIF_IOCTL_MAP_V0_IO; > ????????????????else-- Cheers, Lyude Paul (she/her) Software Engineer at Red Hat