linux-kernel - [PATCH] gpu/drm: fix potential memory leak

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 21 Oct 2021 23:30:35 -0700
From:   Bernard Zhao <bernard@...o.com>
To:     Maarten Lankhorst <maarten.lankhorst@...ux.intel.com>,
        Maxime Ripard <mripard@...nel.org>,
        Thomas Zimmermann <tzimmermann@...e.de>,
        David Airlie <airlied@...ux.ie>,
        Daniel Vetter <daniel@...ll.ch>,
        dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org
Cc:     Bernard Zhao <bernard@...o.com>
Subject: [PATCH] gpu/drm: fix potential memory leak

This patch try to fix memory leak reported by syzbot:
BUG: memory leak
unreferenced object 0xffff888127338180 (size 64):
  comm "syz-executor.6", pid 11434, jiffies 4294961165 (age 15.480s)
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 4a 0d 28 81 88 ff ff  .........J.(....
  backtrace:
    [<ffffffff825b2892>] kmalloc include/linux/slab.h:591 [inline]
    [<ffffffff825b2892>] drm_vma_node_allow+0x32/0x120 drivers/gpu/drm/drm_vma_manager.c:274
    [<ffffffff825983b7>] drm_gem_handle_create_tail+0x107/0x250 drivers/gpu/drm/drm_gem.c:390
    [<ffffffff826271bd>] vgem_gem_create drivers/gpu/drm/vgem/vgem_drv.c:203 [inline]
    [<ffffffff826271bd>] vgem_gem_dumb_create+0x8d/0x240 drivers/gpu/drm/vgem/vgem_drv.c:223
    [<ffffffff825c72f1>] drm_mode_create_dumb+0x121/0x150 drivers/gpu/drm/drm_dumb_buffers.c:96
    [<ffffffff82599660>] drm_ioctl_kernel+0xf0/0x160 drivers/gpu/drm/drm_ioctl.c:795
    [<ffffffff82599c7a>] drm_ioctl+0x2ea/0x4f0 drivers/gpu/drm/drm_ioctl.c:898
    [<ffffffff8158e45c>] vfs_ioctl fs/ioctl.c:51 [inline]
    [<ffffffff8158e45c>] __do_sys_ioctl fs/ioctl.c:1069 [inline]
    [<ffffffff8158e45c>] __se_sys_ioctl fs/ioctl.c:1055 [inline]
    [<ffffffff8158e45c>] __x64_sys_ioctl+0xfc/0x140 fs/ioctl.c:1055
    [<ffffffff843b6675>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff843b6675>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
    [<ffffffff84400068>] entry_SYSCALL_64_after_hwframe+0x44/0xae
The link is:
https://syzkaller.appspot.com/bug?id=bd059c6ee8aee1d3af51cff3a2849b8c0027b822

Signed-off-by: Bernard Zhao <bernard@...o.com>
---
 drivers/gpu/drm/drm_vma_manager.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_vma_manager.c b/drivers/gpu/drm/drm_vma_manager.c
index 7de37f8c68fd..870d5bc7f1fa 100644
--- a/drivers/gpu/drm/drm_vma_manager.c
+++ b/drivers/gpu/drm/drm_vma_manager.c
@@ -300,11 +300,11 @@ int drm_vma_node_allow(struct drm_vma_offset_node *node, struct drm_file *tag)
 	new->vm_count = 1;
 	rb_link_node(&new->vm_rb, parent, iter);
 	rb_insert_color(&new->vm_rb, &node->vm_files);
-	new = NULL;
 
 unlock:
 	write_unlock(&node->vm_lock);
 	kfree(new);
+	new = NULL;
 	return ret;
 }
 EXPORT_SYMBOL(drm_vma_node_allow);
-- 
2.33.1