Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

drm/sched: memset() 'job' in drm_sched_job_init()

drm_sched_job_init() has no control over how users allocate struct
drm_sched_job. Unfortunately, the function can also not set some struct
members such as job->sched.

This could theoretically lead to UB by users dereferencing the struct's
pointer members too early.

It is easier to debug such issues if these pointers are initialized to
NULL, so dereferencing them causes a NULL pointer exception.
Accordingly, drm_sched_entity_init() does precisely that and initializes
its struct with memset().

Initialize parameter "job" to 0 in drm_sched_job_init().

Signed-off-by: Philipp Stanner <pstanner@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20241021105028.19794-2-pstanner@redhat.com
Reviewed-by: Christian König <christian.koenig@amd.com>

+8
+8
drivers/gpu/drm/scheduler/sched_main.c
··· 796 796 return -EINVAL; 797 797 } 798 798 799 + /* 800 + * We don't know for sure how the user has allocated. Thus, zero the 801 + * struct so that unallowed (i.e., too early) usage of pointers that 802 + * this function does not set is guaranteed to lead to a NULL pointer 803 + * exception instead of UB. 804 + */ 805 + memset(job, 0, sizeof(*job)); 806 + 799 807 job->entity = entity; 800 808 job->credits = credits; 801 809 job->s_fence = drm_sched_fence_alloc(entity, owner);