KSPP / linux

Linux kernel source tree (Kernel Self Protection Project)
https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project
Other
80 stars 5 forks source link

Replace fake-flex array with flex-array member in drivers/gpu/drm/nouveau/nouveau_svm.c #338

Closed GustavoARSilva closed 5 months ago

GustavoARSilva commented 10 months ago
diff --git a/drivers/gpu/drm/nouveau/nouveau_svm.c b/drivers/gpu/drm/nouveau/nouveau_svm.c
index 186351ecf72f..00444ad82d18 100644
--- a/drivers/gpu/drm/nouveau/nouveau_svm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_svm.c
@@ -67,7 +67,7 @@ struct nouveau_svm {
                        struct nouveau_svmm *svmm;
                } **fault;
                int fault_nr;
-       } buffer[1];
+       } buffer[];
 };

Audit the code below:

diff -u -p ./drivers/gpu/drm/nouveau/nouveau_svm.c /tmp/nothing/drivers/gpu/drm/nouveau/nouveau_svm.c
--- ./drivers/gpu/drm/nouveau/nouveau_svm.c
+++ /tmp/nothing/drivers/gpu/drm/nouveau/nouveau_svm.c
@@ -942,7 +942,6 @@ nouveau_pfns_map(struct nouveau_svmm *sv
 static void
 nouveau_svm_fault_buffer_fini(struct nouveau_svm *svm, int id)
 {
-       struct nouveau_svm_fault_buffer *buffer = &svm->buffer[id];

        nvif_event_block(&buffer->notify);
        flush_work(&buffer->work);
@@ -951,7 +950,6 @@ nouveau_svm_fault_buffer_fini(struct nou
 static int
 nouveau_svm_fault_buffer_init(struct nouveau_svm *svm, int id)
 {
-       struct nouveau_svm_fault_buffer *buffer = &svm->buffer[id];
        struct nvif_object *device = &svm->drm->client.device.object;

        buffer->get = nvif_rd32(device, buffer->getaddr);
@@ -964,7 +962,6 @@ nouveau_svm_fault_buffer_init(struct nou
 static void
 nouveau_svm_fault_buffer_dtor(struct nouveau_svm *svm, int id)
 {
-       struct nouveau_svm_fault_buffer *buffer = &svm->buffer[id];
        int i;

        if (!nvif_object_constructed(&buffer->object))
@@ -985,7 +982,6 @@ nouveau_svm_fault_buffer_dtor(struct nou
 static int
 nouveau_svm_fault_buffer_ctor(struct nouveau_svm *svm, s32 oclass, int id)
 {
-       struct nouveau_svm_fault_buffer *buffer = &svm->buffer[id];
        struct nouveau_drm *drm = svm->drm;
        struct nvif_object *device = &drm->client.device.object;
        struct nvif_clb069_v0 args = {};
kees commented 5 months ago

Fixed in commit 6ad33b53c9b8a1c99bcd2fb96123d5d45bc88d7b.