linux-kernel - Re: [PATCH] drm/amdgpu: fix memory leak

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 4 Oct 2019 11:13:29 +0000
From:   "Koenig, Christian" <Christian.Koenig@....com>
To:     "Das, Nirmoy" <Nirmoy.Das@....com>,
        Nirmoy Das <nirmoy.aiemd@...il.com>,
        "Deucher, Alexander" <Alexander.Deucher@....com>
CC:     "airlied@...ux.ie" <airlied@...ux.ie>,
        "dri-devel@...ts.freedesktop.org" <dri-devel@...ts.freedesktop.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] drm/amdgpu: fix memory leak

Am 04.10.19 um 13:00 schrieb Das, Nirmoy:
> On 10/4/19 12:44 PM, Koenig, Christian wrote:
>> First of all please send mails regarding amdgpu to the amd-gfx mailing
>> list and not lkml/dri-devel.
> Okay.
>> Am 04.10.19 um 12:17 schrieb Nirmoy Das:
>>> In amdgpu_bo_list_ioctl when idr_alloc fails
>>> don't return without freeing bo list entry.
>>>
>>> Fixes: 964d0fbf6301d ("drm/amdgpu: Allow to create BO lists in CS ioctl v3")
>>>
>>> Signed-off-by: Nirmoy Das <nirmoy.das@....com>
>>> ---
>>>     drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c | 2 +-
>>>     1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
>>> index 7bcf86c61999..c3e5ea544857 100644
>>> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
>>> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
>>> @@ -284,7 +284,7 @@ int amdgpu_bo_list_ioctl(struct drm_device *dev, void *data,
>>>     		mutex_unlock(&fpriv->bo_list_lock);
>>>     		if (r < 0) {
>>>     			amdgpu_bo_list_put(list);
>>> -			return r;
>>> +			goto error_free;
>> NAK, that is a double free. The bo list entries are freed by
>> amdgpu_bo_list_put().
> Thanks, didn't realize that.

Wait a second, what entries are you talking about?

The entries in the list object are freed when amdgpu_bo_list_put() is 
called, but the temporary info array with the handles needs to be freed 
as well.

And it looks like that is indeed leaked here.

Regards,
Christian.

>> Regards,
>> Christian.
> Regards,
>
> Nirmoy
>
>>>     		}
>>>     
>>>     		handle = r;