Thread (1 message) 1 message, 1 author, 2023-06-13

Re: [PATCH 3/5] drm/mediatek: Add initialization for mtk_gem_obj

From: Jason-JH Lin (林睿祥) <hidden>
Date: 2023-06-13 07:20:46
Also in: dri-devel, lkml

Hi CK,

Thanks for the reviews.

On Mon, 2023-06-12 at 08:27 +0000, CK Hu (胡俊光) wrote:
Hi, Jason:

On Fri, 2023-04-07 at 14:46 +0800, Jason-JH.Lin wrote:
quoted
Calling mtk_gem_obj = kzalloc() which returns uninitialized memory,
because mtk_gem_obj is uninitialized.

It may cause using uninitialized value mtk_gem_obj->base.resv
when calling drm_gem_object_init().

So add initialization for mtk_gem_obj.
So weird, nacked by me.

Regards,
CK
I've checked the coverity issue:
1. alloc_fn: Calling kzalloc which returns uninitialized memory. 
2. assign: Assigning: mtk_gem_obj = kzalloc(424UL, 3264U), which points
to uninitialized data.
   mtk_gem_obj = kzalloc(sizeof(*mtk_gem_obj), GFP_KERNEL);

/include/linux/slab.h
733: static inline void *kzalloc(size_t size, gfp_t flags)
734: {
1. uninit_buffer: Call to kmalloc(size, flags | 0x100U) returns an
uninitialized buffer. [Note: The source code implementation of the
function has been overridden by a builtin model.]
2. return: Returning kmalloc(size, flags | 0x100U).


I think it may be a misjudgment to kzalloc returning an uninitialized
memory, so I'll drop this path.

Regards,
Jason-JH.Lin
quoted
Signed-off-by: Jason-JH.Lin <redacted>
Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC
MT8173.")
---
 drivers/gpu/drm/mediatek/mtk_drm_gem.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_gem.c
b/drivers/gpu/drm/mediatek/mtk_drm_gem.c
index a25b28d3ee90..9b8f72ed12e4 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_gem.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_gem.c
@@ -33,7 +33,7 @@ static const struct drm_gem_object_funcs
mtk_drm_gem_object_funcs = {
 static struct mtk_drm_gem_obj *mtk_drm_gem_init(struct drm_device
*dev,
 						unsigned long size)
 {
-	struct mtk_drm_gem_obj *mtk_gem_obj;
+	struct mtk_drm_gem_obj *mtk_gem_obj = NULL;
 	int ret;
 
 	size = round_up(size, PAGE_SIZE);
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help