Skip to content

Commit cdcd6ae

Browse files
committed
drm/vc4: tests: Fix UAF in the mock helpers
The VC4 mock helpers allocate the CRTC, encoders and connectors using a call to kunit_kzalloc(), but the DRM device they are attache to survives for longer than the test itself which leads to use-after-frees reported by KASAN. Switch to drmm_kzalloc to tie the lifetime of these objects to the main DRM device. Fixes: f759f5b ("drm/vc4: tests: Introduce a mocking infrastructure") Reported-by: Linux Kernel Functional Testing <lkft@linaro.org> Closes: https://lore.kernel.org/all/CA+G9fYvJA2HGqzR9LGgq63v0SKaUejHAE6f7+z9cwWN-ourJ_g@mail.gmail.com/ Tested-by: Anders Roxell <anders.roxell@linaro.org> Reviewed-by: Maíra Canal <mcanal@igalia.com> Signed-off-by: Maxime Ripard <mripard@kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20231024105640.352752-1-mripard@kernel.org
1 parent b132ac5 commit cdcd6ae

File tree

2 files changed

+2
-2
lines changed

2 files changed

+2
-2
lines changed

drivers/gpu/drm/vc4/tests/vc4_mock_crtc.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ struct vc4_dummy_crtc *vc4_mock_pv(struct kunit *test,
2626
struct vc4_crtc *vc4_crtc;
2727
int ret;
2828

29-
dummy_crtc = kunit_kzalloc(test, sizeof(*dummy_crtc), GFP_KERNEL);
29+
dummy_crtc = drmm_kzalloc(drm, sizeof(*dummy_crtc), GFP_KERNEL);
3030
KUNIT_ASSERT_NOT_NULL(test, dummy_crtc);
3131

3232
vc4_crtc = &dummy_crtc->crtc;

drivers/gpu/drm/vc4/tests/vc4_mock_output.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ struct vc4_dummy_output *vc4_dummy_output(struct kunit *test,
3232
struct drm_encoder *enc;
3333
int ret;
3434

35-
dummy_output = kunit_kzalloc(test, sizeof(*dummy_output), GFP_KERNEL);
35+
dummy_output = drmm_kzalloc(drm, sizeof(*dummy_output), GFP_KERNEL);
3636
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, dummy_output);
3737
dummy_output->encoder.type = vc4_encoder_type;
3838

0 commit comments

Comments
 (0)