On 2026-09-14 01:46, Karl Mehltretter wrote:
amdgpu_generate_ualink_handle() continues when handle_lo is zero. For accelerator ID 0, the random value can become zero after the low 10 bits are cleared. This path reaches while (!unique) without assigning unique.Clang's -Wconditional-uninitialized reports the read. A reduced MemorySanitizer test reports use-of-uninitialized-value at the loop condition. If the uninitialized value ends the loop, handle 0 is inserted into exp_xa while robj->ualink_handle_lo still says that the BO has no handle. A later export can create another entry for the same BO. Initialize unique to false so the zero-handle path repeats the loop. Fixes: c67cb19811ec ("drm/amdgpu: Implement UALink handle export") Assisted-by: LLM Signed-off-by: Karl Mehltretter <[email protected]>
Thanks for the catch. I'm applying the patch to amd-staging-drm-next. Reviewed-by: Felix Kuehling <[email protected]> Mukul is looking into the other pre-existing issues pointed out by Sashiko. Regards, Felix
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c index ab56420..c6b7122 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c @@ -1819,7 +1819,7 @@ static void amdgpu_ualink_npa_mm_fini(struct amdgpu_device *adev) static void amdgpu_generate_ualink_handle(struct amdgpu_device *adev, struct amdgpu_ualink_handle *handle) { - bool unique; + bool unique = false;do {handle->handle_lo = get_random_u64(); base-commit: 68142f986ff04b2b70b31db00f719bf690f64a9a
