From d6d1ac4b3d936f850aa63373d7ae05ebf7254f81 Mon Sep 17 00:00:00 2001 From: Matthew Auld Date: Mon, 27 Jun 2022 17:10:02 +0100 Subject: tests/i915/gem_eio: fix uaf MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ../tests/i915/gem_eio.c:277:20: warning: pointer ‘ctx’ used after ‘free’ [-Wuse-after-free] 277 | igt_assert(igt_sysfs_printf(ctx->debugfs, "i915_drop_caches", ../lib/igt_core.h:667:20: note: in definition of macro ‘igt_assert’ 667 | do { if (!(expr)) \ | ^~~~ ../tests/i915/gem_eio.c:274:9: note: call to ‘free’ here 274 | free(ctx); Signed-off-by: Matthew Auld Cc: Gwan-gyeong Mun Reviewed-by: Nirmoy Das Reviewed-by: Gwan-gyeong Mun --- tests/i915/gem_eio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/i915/gem_eio.c b/tests/i915/gem_eio.c index 913a21f9..6cbae6eb 100644 --- a/tests/i915/gem_eio.c +++ b/tests/i915/gem_eio.c @@ -270,11 +270,11 @@ static void hang_handler(union sigval arg) igt_nsec_elapsed(&ctx->delay) / 1000.0); igt_assert_eq(timer_delete(ctx->timer), 0); - free(ctx); /* flush any excess work before we start timing our reset */ igt_assert(igt_sysfs_printf(ctx->debugfs, "i915_drop_caches", "%d", DROP_RCU)); + free(ctx); igt_nsec_elapsed(ts); igt_assert(igt_sysfs_printf(dir, "i915_wedged", "%llu", -1ull)); -- cgit v1.2.3