linux-kernel - Re: [PATCH] drm/amdgpu: release allocated memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sat, 21 Sep 2019 11:32:33 +0000
From:   "Koenig, Christian" <Christian.Koenig@....com>
To:     Navid Emamdoost <navid.emamdoost@...il.com>
CC:     "emamd001@....edu" <emamd001@....edu>,
        "smccaman@....edu" <smccaman@....edu>,
        "kjlu@....edu" <kjlu@....edu>,
        "Deucher, Alexander" <Alexander.Deucher@....com>,
        "Zhou, David(ChunMing)" <David1.Zhou@....com>,
        David Airlie <airlied@...ux.ie>,
        Daniel Vetter <daniel@...ll.ch>,
        Sam Ravnborg <sam@...nborg.org>, Rex Zhu <Rex.Zhu@....com>,
        "amd-gfx@...ts.freedesktop.org" <amd-gfx@...ts.freedesktop.org>,
        "dri-devel@...ts.freedesktop.org" <dri-devel@...ts.freedesktop.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] drm/amdgpu: release allocated memory

Am 21.09.19 um 00:49 schrieb Navid Emamdoost:
> In amdgpu_vmid_grab_idle, fences is being leaked in one execution path.
> The missing kfree was added.

NAK, the array is freed by the dma_fence_array.  This is a double free.

Regards,
Christian.

>
> Signed-off-by: Navid Emamdoost <navid.emamdoost@...il.com>
> ---
>   drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c | 1 +
>   1 file changed, 1 insertion(+)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c
> index 57b3d8a9bef3..9063cd36fa94 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c
> @@ -244,6 +244,7 @@ static int amdgpu_vmid_grab_idle(struct amdgpu_vm *vm,
>   		r = amdgpu_sync_fence(adev, sync, &array->base, false);
>   		dma_fence_put(ring->vmid_wait);
>   		ring->vmid_wait = &array->base;
> +		kfree(fences);
>   		return r;
>   	}
>   	kfree(fences);