[PATCH] drm/ttm/tests: fix potential null pointer dereference in ttm_bo_unreserve_bulk()

[Qasim Ijaz]

On Thu, Mar 13, 2025 at 03:20:34PM +0100, Christian König wrote:
> Am 11.03.25 um 20:01 schrieb Qasim Ijaz:
> > In the ttm_bo_unreserve_bulk() test function, resv is allocated 
> > using kunit_kzalloc(), but the subsequent assertion mistakenly 
> > verifies the ttm_dev pointer instead of checking the resv pointer. 
> > This mistake means that if allocation for resv fails, the error will 
> > go undetected, resv will be NULL and a call to dma_resv_init(resv) 
> 
> The description here is correct, but the subject line is a bit misleading.
> 
> Please use something like this instead "drm/ttm/tests: incorrect assert in ttm_bo_unreserve_bulk()".
> 
> > will dereference a NULL pointer. 
> 
> That irrelevant, an allocation failure will result in a NULL pointer deref anyway. This is just an unit test.
> 
> >
> > Fix the assertion to properly verify the resv pointer.
> >
> > Fixes: 588c4c8d58c4 ("drm/ttm/tests: Fix a warning in ttm_bo_unreserve_bulk")
> > Cc: stable at vger.kernel.org
> 
> Please drop those tags. This is just an unit test, not relevant for stability and therefore shouldn't be backported.
> 
> Regards,
> Christian.
> 
Thank you for the feedback Christian, I will resend a new patch with the
changes you described.

Thanks,
Qasim.
> > Signed-off-by: Qasim Ijaz <qasdev00 at gmail.com>
> > ---
> >  drivers/gpu/drm/ttm/tests/ttm_bo_test.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/gpu/drm/ttm/tests/ttm_bo_test.c b/drivers/gpu/drm/ttm/tests/ttm_bo_test.c
> > index f8f20d2f6174..e08e5a138420 100644
> > --- a/drivers/gpu/drm/ttm/tests/ttm_bo_test.c
> > +++ b/drivers/gpu/drm/ttm/tests/ttm_bo_test.c
> > @@ -340,7 +340,7 @@ static void ttm_bo_unreserve_bulk(struct kunit *test)
> >  	KUNIT_ASSERT_NOT_NULL(test, ttm_dev);
> >  
> >  	resv = kunit_kzalloc(test, sizeof(*resv), GFP_KERNEL);
> > -	KUNIT_ASSERT_NOT_NULL(test, ttm_dev);
> > +	KUNIT_ASSERT_NOT_NULL(test, resv);
> >  
> >  	err = ttm_device_kunit_init(priv, ttm_dev, false, false);
> >  	KUNIT_ASSERT_EQ(test, err, 0);
>