]> www.infradead.org Git - users/jedix/linux-maple.git/commit
iosys-map: Fix undefined behavior in iosys_map_clear()
authorNitin Gote <nitin.r.gote@intel.com>
Fri, 18 Jul 2025 10:50:51 +0000 (16:20 +0530)
committerThomas Zimmermann <tzimmermann@suse.de>
Mon, 11 Aug 2025 15:26:38 +0000 (17:26 +0200)
commit5634c8cb298a7146b4e38873473e280b50e27a2c
tree96db837ffc32573063b2798502679c1eff7f7f43
parent05663d88fd0b8ee1c54ab2d5fb36f9b6a3ed37f7
iosys-map: Fix undefined behavior in iosys_map_clear()

The current iosys_map_clear() implementation reads the potentially
uninitialized 'is_iomem' boolean field to decide which union member
to clear. This causes undefined behavior when called on uninitialized
structures, as 'is_iomem' may contain garbage values like 0xFF.

UBSAN detects this as:
    UBSAN: invalid-load in include/linux/iosys-map.h:267
    load of value 255 is not a valid value for type '_Bool'

Fix by unconditionally clearing the entire structure with memset(),
eliminating the need to read uninitialized data and ensuring all
fields are set to known good values.

Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14639
Fixes: 01fd30da0474 ("dma-buf: Add struct dma-buf-map for storing struct dma_buf.vaddr_ptr")
Signed-off-by: Nitin Gote <nitin.r.gote@intel.com>
Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://lore.kernel.org/r/20250718105051.2709487-1-nitin.r.gote@intel.com
include/linux/iosys-map.h