lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 21 Jan 2022 08:45:06 +0100 From: Christian König <christian.koenig@....com> To: Xin Xiong <xiongx18@...an.edu.cn>, Alex Deucher <alexander.deucher@....com>, "Pan, Xinhui" <Xinhui.Pan@....com>, David Airlie <airlied@...ux.ie>, Daniel Vetter <daniel@...ll.ch>, Sumit Semwal <sumit.semwal@...aro.org>, amd-gfx@...ts.freedesktop.org, dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org, linux-media@...r.kernel.org, linaro-mm-sig@...ts.linaro.org Cc: yuanxzhang@...an.edu.cn, Xin Tan <tanxin.ctf@...il.com> Subject: Re: [PATCH] drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj Am 21.01.22 um 06:28 schrieb Xin Xiong: > This issue takes place in an error path in > amdgpu_cs_fence_to_handle_ioctl(). When `info->in.what` falls into > default case, the function simply returns -EINVAL, forgetting to > decrement the reference count of a dma_fence obj, which is bumped > earlier by amdgpu_cs_get_fence(). This may result in reference count > leaks. > > Fix it by decreasing the refcount of specific object before returning > the error code. > > Signed-off-by: Xin Xiong <xiongx18@...an.edu.cn> > Signed-off-by: Xin Tan <tanxin.ctf@...il.com> Good catch. Reviewed-by: Christian König <christian.koenig@....com> > --- > drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c > index 0311d799a..894869789 100644 > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c > @@ -1510,6 +1510,7 @@ int amdgpu_cs_fence_to_handle_ioctl(struct drm_device *dev, void *data, > return 0; > > default: > + dma_fence_put(fence); > return -EINVAL; > } > }
Powered by blists - more mailing lists