linux-kernel - [PATCH] drm/v3d: fix reference count leaks due to pm_runtime_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20200614024459.126372-1-pakki001@umn.edu>
Date:   Sat, 13 Jun 2020 21:44:59 -0500
From:   Aditya Pakki <pakki001@....edu>
To:     pakki001@....edu
Cc:     kjlu@....edu, wu000273@....edu, Eric Anholt <eric@...olt.net>,
        David Airlie <airlied@...ux.ie>,
        Daniel Vetter <daniel@...ll.ch>,
        dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org
Subject: [PATCH] drm/v3d: fix reference count leaks due to pm_runtime_get_sync

On calling pm_runtime_get_sync() the reference count of the device
is incremented. In case of failure, decrement the
reference count before returning the error.

Signed-off-by: Aditya Pakki <pakki001@....edu>
---
 drivers/gpu/drm/v3d/v3d_debugfs.c | 8 ++++++--
 drivers/gpu/drm/v3d/v3d_drv.c     | 4 +++-
 drivers/gpu/drm/v3d/v3d_gem.c     | 4 +++-
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/v3d/v3d_debugfs.c b/drivers/gpu/drm/v3d/v3d_debugfs.c
index e76b24bb8828..7ceb945e3a31 100644
--- a/drivers/gpu/drm/v3d/v3d_debugfs.c
+++ b/drivers/gpu/drm/v3d/v3d_debugfs.c
@@ -133,8 +133,10 @@ static int v3d_v3d_debugfs_ident(struct seq_file *m, void *unused)
 	int ret, core;
 
 	ret = pm_runtime_get_sync(v3d->drm.dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_autosuspend(v3d->drm.dev);
 		return ret;
+	}
 
 	ident0 = V3D_READ(V3D_HUB_IDENT0);
 	ident1 = V3D_READ(V3D_HUB_IDENT1);
@@ -220,8 +222,10 @@ static int v3d_measure_clock(struct seq_file *m, void *unused)
 	int ret;
 
 	ret = pm_runtime_get_sync(v3d->drm.dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_autosuspend(v3d->drm.dev);
 		return ret;
+	}
 
 	if (v3d->ver >= 40) {
 		V3D_CORE_WRITE(core, V3D_V4_PCTR_0_SRC_0_3,
diff --git a/drivers/gpu/drm/v3d/v3d_drv.c b/drivers/gpu/drm/v3d/v3d_drv.c
index 82a7dfdd14c2..9b0a60b0bc11 100644
--- a/drivers/gpu/drm/v3d/v3d_drv.c
+++ b/drivers/gpu/drm/v3d/v3d_drv.c
@@ -106,8 +106,10 @@ static int v3d_get_param_ioctl(struct drm_device *dev, void *data,
 			return -EINVAL;
 
 		ret = pm_runtime_get_sync(v3d->drm.dev);
-		if (ret < 0)
+		if (ret < 0) {
+			pm_runtime_put_autosuspend(v3d->drm.dev);
 			return ret;
+		}
 		if (args->param >= DRM_V3D_PARAM_V3D_CORE0_IDENT0 &&
 		    args->param <= DRM_V3D_PARAM_V3D_CORE0_IDENT2) {
 			args->value = V3D_CORE_READ(0, offset);
diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c
index 09a7639cf161..f2980632896a 100644
--- a/drivers/gpu/drm/v3d/v3d_gem.c
+++ b/drivers/gpu/drm/v3d/v3d_gem.c
@@ -440,8 +440,10 @@ v3d_job_init(struct v3d_dev *v3d, struct drm_file *file_priv,
 	job->free = free;
 
 	ret = pm_runtime_get_sync(v3d->drm.dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_autosuspend(v3d->drm.dev);
 		return ret;
+	}
 
 	xa_init_flags(&job->deps, XA_FLAGS_ALLOC);
 
-- 
2.25.1