1. Patchew
  2. linux
  3. View series

[PATCH V4] drm/xe/guc: Fix dereference before NULL check

Everest K.C. posted 1 patch 1 year, 2 months ago
There is a newer version of this series
drivers/gpu/drm/xe/xe_guc_capture.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
[PATCH V4] drm/xe/guc: Fix dereference before NULL check
Posted by Everest K.C. 1 year, 2 months ago 
The pointer list->list is dereferenced before the NULL check.
Fix this by moving the NULL check outside the for loop, so that
the check is performed before the dereferencing.
The list->list pointer cannot be NULL so this has no effect on runtime.
It's just a correctness issue.

This issue was reported by Coverity Scan.
https://scan7.scan.coverity.com/#/project-view/51525/11354?selectedIssue=1600335

Fixes: 0f1fdf559225 ("drm/xe/guc: Save manual engine capture into capture list")
Signed-off-by: Everest K.C. <everestkc@everestkc.com.np>
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
---
V3 -> V4: - Corrected the Fixes tag
          - Added Reviewed-by tag
V2 -> V3: - Changed Null to NULL in the changelog
          - Corrected typo in the changelong
          - Added more description to the changelong
	  - Fixed the link for Coverity Report
	  - Removed the space after the Fixes tag
V1 -> V2: - Combined the `!list->list` check in preexisting if statement
	  - Added Fixes tag 
	  - Added the link to the Coverity Scan report 

 drivers/gpu/drm/xe/xe_guc_capture.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/xe/xe_guc_capture.c b/drivers/gpu/drm/xe/xe_guc_capture.c
index 41262bda20ed..947c3a6d0e5a 100644
--- a/drivers/gpu/drm/xe/xe_guc_capture.c
+++ b/drivers/gpu/drm/xe/xe_guc_capture.c
@@ -1531,7 +1531,7 @@ read_reg_to_node(struct xe_hw_engine *hwe, const struct __guc_mmio_reg_descr_gro
 {
 	int i;
 
-	if (!list || list->num_regs == 0)
+	if (!list || !list->list || list->num_regs == 0)
 		return;
 
 	if (!regs)
@@ -1541,9 +1541,6 @@ read_reg_to_node(struct xe_hw_engine *hwe, const struct __guc_mmio_reg_descr_gro
 		struct __guc_mmio_reg_descr desc = list->list[i];
 		u32 value;
 
-		if (!list->list)
-			return;
-
 		if (list->type == GUC_STATE_CAPTURE_TYPE_ENGINE_INSTANCE) {
 			value = xe_hw_engine_mmio_read32(hwe, desc.reg);
 		} else {
-- 
2.43.0
Re: [PATCH V4] drm/xe/guc: Fix dereference before NULL check
Posted by Rodrigo Vivi 1 year, 1 month ago 
On Thu, Oct 10, 2024 at 10:57:59AM -0600, Everest K.C. wrote:
> The pointer list->list is dereferenced before the NULL check.
> Fix this by moving the NULL check outside the for loop, so that
> the check is performed before the dereferencing.
> The list->list pointer cannot be NULL so this has no effect on runtime.
> It's just a correctness issue.
> 
> This issue was reported by Coverity Scan.
> https://scan7.scan.coverity.com/#/project-view/51525/11354?selectedIssue=1600335
> 
> Fixes: 0f1fdf559225 ("drm/xe/guc: Save manual engine capture into capture list")
> Signed-off-by: Everest K.C. <everestkc@everestkc.com.np>
> Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
> ---
> V3 -> V4: - Corrected the Fixes tag
>           - Added Reviewed-by tag

For some reason it looks like nor CI nor lore has this v4 version.

could you please resubmit it?

> V2 -> V3: - Changed Null to NULL in the changelog
>           - Corrected typo in the changelong
>           - Added more description to the changelong
> 	  - Fixed the link for Coverity Report
> 	  - Removed the space after the Fixes tag
> V1 -> V2: - Combined the `!list->list` check in preexisting if statement
> 	  - Added Fixes tag 
> 	  - Added the link to the Coverity Scan report 
> 
>  drivers/gpu/drm/xe/xe_guc_capture.c | 5 +----
>  1 file changed, 1 insertion(+), 4 deletions(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_guc_capture.c b/drivers/gpu/drm/xe/xe_guc_capture.c
> index 41262bda20ed..947c3a6d0e5a 100644
> --- a/drivers/gpu/drm/xe/xe_guc_capture.c
> +++ b/drivers/gpu/drm/xe/xe_guc_capture.c
> @@ -1531,7 +1531,7 @@ read_reg_to_node(struct xe_hw_engine *hwe, const struct __guc_mmio_reg_descr_gro
>  {
>  	int i;
>  
> -	if (!list || list->num_regs == 0)
> +	if (!list || !list->list || list->num_regs == 0)
>  		return;
>  
>  	if (!regs)
> @@ -1541,9 +1541,6 @@ read_reg_to_node(struct xe_hw_engine *hwe, const struct __guc_mmio_reg_descr_gro
>  		struct __guc_mmio_reg_descr desc = list->list[i];
>  		u32 value;
>  
> -		if (!list->list)
> -			return;
> -
>  		if (list->type == GUC_STATE_CAPTURE_TYPE_ENGINE_INSTANCE) {
>  			value = xe_hw_engine_mmio_read32(hwe, desc.reg);
>  		} else {
> -- 
> 2.43.0
>
Re: [PATCH V4] drm/xe/guc: Fix dereference before NULL check
Posted by Everest K.C. 1 year, 1 month ago 
On Wed, Oct 23, 2024 at 2:11 PM Rodrigo Vivi <rodrigo.vivi@intel.com> wrote:
>
> On Thu, Oct 10, 2024 at 10:57:59AM -0600, Everest K.C. wrote:
> > The pointer list->list is dereferenced before the NULL check.
> > Fix this by moving the NULL check outside the for loop, so that
> > the check is performed before the dereferencing.
> > The list->list pointer cannot be NULL so this has no effect on runtime.
> > It's just a correctness issue.
> >
> > This issue was reported by Coverity Scan.
> > https://scan7.scan.coverity.com/#/project-view/51525/11354?selectedIssue=1600335
> >
> > Fixes: 0f1fdf559225 ("drm/xe/guc: Save manual engine capture into capture list")
> > Signed-off-by: Everest K.C. <everestkc@everestkc.com.np>
> > Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
> > ---
> > V3 -> V4: - Corrected the Fixes tag
> >           - Added Reviewed-by tag
>
> For some reason it looks like nor CI nor lore has this v4 version.
Yeah, I just checked that and it's something strange.
> could you please resubmit it?
Yes, let me send it right away.
> > V2 -> V3: - Changed Null to NULL in the changelog
> >           - Corrected typo in the changelong
> >           - Added more description to the changelong
> >         - Fixed the link for Coverity Report
> >         - Removed the space after the Fixes tag
> > V1 -> V2: - Combined the `!list->list` check in preexisting if statement
> >         - Added Fixes tag
> >         - Added the link to the Coverity Scan report
> >
> >  drivers/gpu/drm/xe/xe_guc_capture.c | 5 +----
> >  1 file changed, 1 insertion(+), 4 deletions(-)
> >
> > diff --git a/drivers/gpu/drm/xe/xe_guc_capture.c b/drivers/gpu/drm/xe/xe_guc_capture.c
> > index 41262bda20ed..947c3a6d0e5a 100644
> > --- a/drivers/gpu/drm/xe/xe_guc_capture.c
> > +++ b/drivers/gpu/drm/xe/xe_guc_capture.c
> > @@ -1531,7 +1531,7 @@ read_reg_to_node(struct xe_hw_engine *hwe, const struct __guc_mmio_reg_descr_gro
> >  {
> >       int i;
> >
> > -     if (!list || list->num_regs == 0)
> > +     if (!list || !list->list || list->num_regs == 0)
> >               return;
> >
> >       if (!regs)
> > @@ -1541,9 +1541,6 @@ read_reg_to_node(struct xe_hw_engine *hwe, const struct __guc_mmio_reg_descr_gro
> >               struct __guc_mmio_reg_descr desc = list->list[i];
> >               u32 value;
> >
> > -             if (!list->list)
> > -                     return;
> > -
> >               if (list->type == GUC_STATE_CAPTURE_TYPE_ENGINE_INSTANCE) {
> >                       value = xe_hw_engine_mmio_read32(hwe, desc.reg);
> >               } else {
> > --
> > 2.43.0
> >

With Regards,
Everest K C

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.