linux-kernel - Re: [PATCH] drm/amdgpu: fix memory leak

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 4 Oct 2019 10:44:04 +0000
From:   "Koenig, Christian" <Christian.Koenig@....com>
To:     Nirmoy Das <nirmoy.aiemd@...il.com>,
        "Deucher, Alexander" <Alexander.Deucher@....com>
CC:     "airlied@...ux.ie" <airlied@...ux.ie>,
        "dri-devel@...ts.freedesktop.org" <dri-devel@...ts.freedesktop.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "Das, Nirmoy" <Nirmoy.Das@....com>
Subject: Re: [PATCH] drm/amdgpu: fix memory leak

First of all please send mails regarding amdgpu to the amd-gfx mailing 
list and not lkml/dri-devel.

Am 04.10.19 um 12:17 schrieb Nirmoy Das:
> In amdgpu_bo_list_ioctl when idr_alloc fails
> don't return without freeing bo list entry.
>
> Fixes: 964d0fbf6301d ("drm/amdgpu: Allow to create BO lists in CS ioctl v3")
>
> Signed-off-by: Nirmoy Das <nirmoy.das@....com>
> ---
>   drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
> index 7bcf86c61999..c3e5ea544857 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
> @@ -284,7 +284,7 @@ int amdgpu_bo_list_ioctl(struct drm_device *dev, void *data,
>   		mutex_unlock(&fpriv->bo_list_lock);
>   		if (r < 0) {
>   			amdgpu_bo_list_put(list);
> -			return r;
> +			goto error_free;

NAK, that is a double free. The bo list entries are freed by 
amdgpu_bo_list_put().

Regards,
Christian.

>   		}
>   
>   		handle = r;