[igt-dev] [PATCH i-g-t 1/3] tests/i915/gem_eio: fix uaf

[Matthew Auld]

On 28/06/2022 11:24, Gwan-gyeong Mun wrote:
> Looks good to me.
> 
> Reviewed-by: Gwan-gyeong Mun <gwan-gyeong.mun at intel.com>
> 
> However, the use after free build issue did not occur only with the "$ 
> meson build && ninja -C build" build command guided by the igt 
> README.md. How did you check it?

Hmm, I assume it's just a difference in compiler version or so. I have: 
gcc (GCC) 12.1.1 20220507 (Red Hat 12.1.1-1).

> 
> Br,
> 
> G.G.
> 
> 
> On 6/27/22 7:10 PM, Matthew Auld wrote:
>> ../tests/i915/gem_eio.c:277:20: warning: pointer ‘ctx’ used after 
>> ‘free’ [-Wuse-after-free]
>>    277 |         igt_assert(igt_sysfs_printf(ctx->debugfs, 
>> "i915_drop_caches",
>> ../lib/igt_core.h:667:20: note: in definition of macro ‘igt_assert’
>>    667 |         do { if (!(expr)) \
>>        |                    ^~~~
>> ../tests/i915/gem_eio.c:274:9: note: call to ‘free’ here
>>    274 |         free(ctx);
>>
>> Signed-off-by: Matthew Auld <matthew.auld at intel.com>
>> Cc: Gwan-gyeong Mun <gwan-gyeong.mun at intel.com>
>> ---
>>   tests/i915/gem_eio.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/tests/i915/gem_eio.c b/tests/i915/gem_eio.c
>> index 913a21f9..6cbae6eb 100644
>> --- a/tests/i915/gem_eio.c
>> +++ b/tests/i915/gem_eio.c
>> @@ -270,11 +270,11 @@ static void hang_handler(union sigval arg)
>>             igt_nsec_elapsed(&ctx->delay) / 1000.0);
>>       igt_assert_eq(timer_delete(ctx->timer), 0);
>> -    free(ctx);
>>       /* flush any excess work before we start timing our reset */
>>       igt_assert(igt_sysfs_printf(ctx->debugfs, "i915_drop_caches",
>>                       "%d", DROP_RCU));
>> +    free(ctx);
>>       igt_nsec_elapsed(ts);
>>       igt_assert(igt_sysfs_printf(dir, "i915_wedged", "%llu", -1ull));
>>