| Message ID | 20230407064657.12350-4-jason-jh.lin@mediatek.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Fix mediatek-drm coverity issues | expand |
Hi, Jason: On Fri, 2023-04-07 at 14:46 +0800, Jason-JH.Lin wrote: > Calling mtk_gem_obj = kzalloc() which returns uninitialized memory, > because mtk_gem_obj is uninitialized. > > It may cause using uninitialized value mtk_gem_obj->base.resv > when calling drm_gem_object_init(). > > So add initialization for mtk_gem_obj. So weird, nacked by me. Regards, CK > > Signed-off-by: Jason-JH.Lin <jason-jh.lin@mediatek.com> > Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC > MT8173.") > --- > drivers/gpu/drm/mediatek/mtk_drm_gem.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/mediatek/mtk_drm_gem.c > b/drivers/gpu/drm/mediatek/mtk_drm_gem.c > index a25b28d3ee90..9b8f72ed12e4 100644 > --- a/drivers/gpu/drm/mediatek/mtk_drm_gem.c > +++ b/drivers/gpu/drm/mediatek/mtk_drm_gem.c > @@ -33,7 +33,7 @@ static const struct drm_gem_object_funcs > mtk_drm_gem_object_funcs = { > static struct mtk_drm_gem_obj *mtk_drm_gem_init(struct drm_device > *dev, > unsigned long size) > { > - struct mtk_drm_gem_obj *mtk_gem_obj; > + struct mtk_drm_gem_obj *mtk_gem_obj = NULL; > int ret; > > size = round_up(size, PAGE_SIZE);
Hi CK, Thanks for the reviews. On Mon, 2023-06-12 at 08:27 +0000, CK Hu (胡俊光) wrote: > Hi, Jason: > > On Fri, 2023-04-07 at 14:46 +0800, Jason-JH.Lin wrote: > > Calling mtk_gem_obj = kzalloc() which returns uninitialized memory, > > because mtk_gem_obj is uninitialized. > > > > It may cause using uninitialized value mtk_gem_obj->base.resv > > when calling drm_gem_object_init(). > > > > So add initialization for mtk_gem_obj. > > So weird, nacked by me. > > Regards, > CK > I've checked the coverity issue: 1. alloc_fn: Calling kzalloc which returns uninitialized memory. 2. assign: Assigning: mtk_gem_obj = kzalloc(424UL, 3264U), which points to uninitialized data. mtk_gem_obj = kzalloc(sizeof(*mtk_gem_obj), GFP_KERNEL); /include/linux/slab.h 733: static inline void *kzalloc(size_t size, gfp_t flags) 734: { 1. uninit_buffer: Call to kmalloc(size, flags | 0x100U) returns an uninitialized buffer. [Note: The source code implementation of the function has been overridden by a builtin model.] 2. return: Returning kmalloc(size, flags | 0x100U). I think it may be a misjudgment to kzalloc returning an uninitialized memory, so I'll drop this path. Regards, Jason-JH.Lin > > > > Signed-off-by: Jason-JH.Lin <jason-jh.lin@mediatek.com> > > Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC > > MT8173.") > > --- > > drivers/gpu/drm/mediatek/mtk_drm_gem.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/drivers/gpu/drm/mediatek/mtk_drm_gem.c > > b/drivers/gpu/drm/mediatek/mtk_drm_gem.c > > index a25b28d3ee90..9b8f72ed12e4 100644 > > --- a/drivers/gpu/drm/mediatek/mtk_drm_gem.c > > +++ b/drivers/gpu/drm/mediatek/mtk_drm_gem.c > > @@ -33,7 +33,7 @@ static const struct drm_gem_object_funcs > > mtk_drm_gem_object_funcs = { > > static struct mtk_drm_gem_obj *mtk_drm_gem_init(struct drm_device > > *dev, > > unsigned long size) > > { > > - struct mtk_drm_gem_obj *mtk_gem_obj; > > + struct mtk_drm_gem_obj *mtk_gem_obj = NULL; > > int ret; > > > > size = round_up(size, PAGE_SIZE);
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_gem.c b/drivers/gpu/drm/mediatek/mtk_drm_gem.c index a25b28d3ee90..9b8f72ed12e4 100644 --- a/drivers/gpu/drm/mediatek/mtk_drm_gem.c +++ b/drivers/gpu/drm/mediatek/mtk_drm_gem.c @@ -33,7 +33,7 @@ static const struct drm_gem_object_funcs mtk_drm_gem_object_funcs = { static struct mtk_drm_gem_obj *mtk_drm_gem_init(struct drm_device *dev, unsigned long size) { - struct mtk_drm_gem_obj *mtk_gem_obj; + struct mtk_drm_gem_obj *mtk_gem_obj = NULL; int ret; size = round_up(size, PAGE_SIZE);
Calling mtk_gem_obj = kzalloc() which returns uninitialized memory, because mtk_gem_obj is uninitialized. It may cause using uninitialized value mtk_gem_obj->base.resv when calling drm_gem_object_init(). So add initialization for mtk_gem_obj. Signed-off-by: Jason-JH.Lin <jason-jh.lin@mediatek.com> Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") --- drivers/gpu/drm/mediatek/mtk_drm_gem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)