Skip to content

Commit 6b14c9c

Browse files
NitinGotegregkh
authored andcommitted
iosys-map: Fix undefined behavior in iosys_map_clear()
[ Upstream commit 5634c8c ] The current iosys_map_clear() implementation reads the potentially uninitialized 'is_iomem' boolean field to decide which union member to clear. This causes undefined behavior when called on uninitialized structures, as 'is_iomem' may contain garbage values like 0xFF. UBSAN detects this as: UBSAN: invalid-load in include/linux/iosys-map.h:267 load of value 255 is not a valid value for type '_Bool' Fix by unconditionally clearing the entire structure with memset(), eliminating the need to read uninitialized data and ensuring all fields are set to known good values. Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14639 Fixes: 01fd30d ("dma-buf: Add struct dma-buf-map for storing struct dma_buf.vaddr_ptr") Signed-off-by: Nitin Gote <nitin.r.gote@intel.com> Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://lore.kernel.org/r/20250718105051.2709487-1-nitin.r.gote@intel.com Signed-off-by: Sasha Levin <sashal@kernel.org>
1 parent 9ab0579 commit 6b14c9c

File tree

1 file changed

+1
-6
lines changed

1 file changed

+1
-6
lines changed

include/linux/iosys-map.h

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -264,12 +264,7 @@ static inline bool iosys_map_is_set(const struct iosys_map *map)
264264
*/
265265
static inline void iosys_map_clear(struct iosys_map *map)
266266
{
267-
if (map->is_iomem) {
268-
map->vaddr_iomem = NULL;
269-
map->is_iomem = false;
270-
} else {
271-
map->vaddr = NULL;
272-
}
267+
memset(map, 0, sizeof(*map));
273268
}
274269

275270
/**

0 commit comments

Comments
 (0)