linux-kernel - Re: [PATCH] drm/amdgpu: Fix memory leak in amdgpu_cs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 10 Nov 2022 13:07:45 -0500
From:   Luben Tuikov <luben.tuikov@....com>
To:     Dong Chenchen <dongchenchen2@...wei.com>, airlied@...il.com,
        daniel@...ll.ch
Cc:     Xinhui.Pan@....com, yuehaibing@...wei.com,
        linux-kernel@...r.kernel.org, dri-devel@...ts.freedesktop.org,
        amd-gfx@...ts.freedesktop.org, alexander.deucher@....com,
        christian.koenig@....com
Subject: Re: [PATCH] drm/amdgpu: Fix memory leak in amdgpu_cs_pass1

Thanks for fixing this.

Please add a Cc tag to stable, and repost.

Reviewed-by: Luben Tuikov <luben.tuikov@....com>

Regards,
Luben

On 2022-11-10 09:33, Dong Chenchen wrote:
> When p->gang_size equals 0, amdgpu_cs_pass1() will return directly
> without freeing chunk_array, which will cause a memory leak issue,
> this patch fixes it.
> 
> Fixes: 4624459c84d7 ("drm/amdgpu: add gang submit frontend v6")
> Signed-off-by: Dong Chenchen <dongchenchen2@...wei.com>
> ---
>  drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> index 1bbd39b3b0fc..0e24d6b80e0b 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> @@ -287,8 +287,10 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p,
>  		}
>  	}
>  
> -	if (!p->gang_size)
> -		return -EINVAL;
> +	if (!p->gang_size) {
> +		ret = -EINVAL;
> +		goto free_partial_kdata;
> +	}
>  
>  	for (i = 0; i < p->gang_size; ++i) {
>  		ret = amdgpu_job_alloc(p->adev, num_ibs[i], &p->jobs[i], vm);