linux-kernel - Re: [PATCH] drm/atomic: fix memory leak when fetching format name

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 11 Nov 2016 17:17:49 +0000
From:   Eric Engestrom <eric.engestrom@...tec.com>
To:     Colin King <colin.king@...onical.com>
CC:     David Airlie <airlied@...ux.ie>, <dri-devel@...ts.freedesktop.org>,
        <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] drm/atomic: fix memory leak when fetching format name

On Friday, 2016-11-11 16:26:22 +0000, Colin King wrote:
> From: Colin Ian King <colin.king@...onical.com>
> 
> drm_get_format_name allocates memory that is not currently free'd
> when printing the state. Fix this by kfree'ing the memory after
> use.

You are correct, but there are more cases of this, and another fix
has been chosen. See this patch [1] for the fix and the rest of that
thread [2] for the discussion.

I'll send v4 (rebase and a missed `const`) as soon as I have the time,
but the usage will remain the same as in v3.

Cheers,
  Eric

[1] https://lists.freedesktop.org/archives/dri-devel/2016-November/123250.html
[2] https://lists.freedesktop.org/archives/dri-devel/2016-November/thread.html#122845

> 
> Signed-off-by: Colin Ian King <colin.king@...onical.com>
> ---
>  drivers/gpu/drm/drm_atomic.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
> index f5ea7db..1d5e86a 100644
> --- a/drivers/gpu/drm/drm_atomic.c
> +++ b/drivers/gpu/drm/drm_atomic.c
> @@ -917,9 +917,10 @@ static void drm_atomic_plane_print_state(struct drm_printer *p,
>  	if (state->fb) {
>  		struct drm_framebuffer *fb = state->fb;
>  		int i, n = drm_format_num_planes(fb->pixel_format);
> +		char *format_name = drm_get_format_name(fb->pixel_format);
>  
> -		drm_printf(p, "\t\tformat=%s\n",
> -				drm_get_format_name(fb->pixel_format));
> +		drm_printf(p, "\t\tformat=%s\n", format_name);
> +		kfree(format_name);
>  		drm_printf(p, "\t\tsize=%dx%d\n", fb->width, fb->height);
>  		drm_printf(p, "\t\tlayers:\n");
>  		for (i = 0; i < n; i++) {
> -- 
> 2.10.2
>