linux-kernel - Re: [PATCH 5.10 32/77] drm/ttm: fix memleak in ttm_transfered

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <871r3x2f0y.fsf@turtle.gmx.de>
Date:   Wed, 03 Nov 2021 20:52:13 +0100
From:   Sven Joachim <svenjoac@....de>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        Christian König <christian.koenig@....com>,
        "Erhard F." <erhard_f@...lbox.org>, Huang Rui <ray.huang@....com>,
        nouveau@...ts.freedesktop.org
Subject: Re: [PATCH 5.10 32/77] drm/ttm: fix memleak in ttm_transfered_destroy

On 2021-11-01 10:17 +0100, Greg Kroah-Hartman wrote:

> From: Christian König <christian.koenig@....com>
>
> commit 0db55f9a1bafbe3dac750ea669de9134922389b5 upstream.
>
> We need to cleanup the fences for ghost objects as well.
>
> Signed-off-by: Christian König <christian.koenig@....com>
> Reported-by: Erhard F. <erhard_f@...lbox.org>
> Tested-by: Erhard F. <erhard_f@...lbox.org>
> Reviewed-by: Huang Rui <ray.huang@....com>
> Bug: https://bugzilla.kernel.org/show_bug.cgi?id=214029
> Bug: https://bugzilla.kernel.org/show_bug.cgi?id=214447
> CC: <stable@...r.kernel.org>
> Link: https://patchwork.freedesktop.org/patch/msgid/20211020173211.2247-1-christian.koenig@amd.com
> Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
> ---
>  drivers/gpu/drm/ttm/ttm_bo_util.c |    1 +
>  1 file changed, 1 insertion(+)
>
> --- a/drivers/gpu/drm/ttm/ttm_bo_util.c
> +++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
> @@ -322,6 +322,7 @@ static void ttm_transfered_destroy(struc
>  	struct ttm_transfer_obj *fbo;
>  
>  	fbo = container_of(bo, struct ttm_transfer_obj, base);
> +	dma_resv_fini(&fbo->base.base._resv);
>  	ttm_bo_put(fbo->bo);
>  	kfree(fbo);
>  }

Alas, this innocuous looking commit causes one of my systems to lock up
as soon as run startx.  This happens with the nouveau driver, two other
systems with radeon and intel graphics are not affected.  Also I only
noticed it in 5.10.77.  Kernels 5.15 and 5.14.16 are not affected, and I
do not use 5.4 anymore.

I am not familiar with nouveau's ttm management and what has changed
there between 5.10 and 5.14, but maybe one of their developers can shed
a light on this.

Cheers,
       Sven