linux-kernel - [Intel-gfx] [PATCH] drm/i915/dp: fix a memory leak in struct intel_vbt_panel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20230608024527.1280985-1-yongxin.liu@windriver.com>
Date:   Thu,  8 Jun 2023 10:45:27 +0800
From:   Yongxin Liu <yongxin.liu@...driver.com>
To:     intel-gfx@...ts.freedesktop.org
Cc:     linux-kernel@...r.kernel.org
Subject: [Intel-gfx] [PATCH] drm/i915/dp: fix a memory leak in struct intel_vbt_panel_data

In commit 3f9ffce5765d ("drm/i915: Do panel VBT init early if the VBT
declares an explicit panel type"), intel_bios_init_panel_early() was
added to intel_edp_init_connector(), and it may call parse_lfp_panel_dtd()
to alloc memory for panel->vbt.lfp_lvds_vbt_mode.

If intel_edp_init_connector() returns false from lable out_vdd_off, the
memory pointed by panel->vbt.lfp_lvds_vbt_mode will be eventually lost by
kfree(connector) in intel_ddi_init_dp_connector().

Fix the following memory leak.

  unreferenced object 0xffff9e076562f100 (size 128):
    comm "modprobe", pid 365, jiffies 4294749388 (age 73.473s)
    hex dump (first 32 bytes):
      14 44 02 00 80 07 d8 07 05 08 98 08 00 00 38 04  .D............8.
      3b 04 41 04 65 04 00 00 0a 00 00 00 00 00 00 00  ;.A.e...........
    backtrace:
      __kmem_cache_alloc_node+0x1e6/0x3d0
      kmalloc_trace+0x2a/0xf0
      parse_lfp_data+0x1a9/0x300 [i915]
      intel_bios_init_panel+0x131/0x3d0 [i915]
      intel_bios_init_panel_early+0x13/0x20 [i915]
      intel_edp_init_connector+0xb2/0x620 [i915]
      intel_dp_init_connector+0x277/0x490 [i915]
      intel_ddi_init+0x877/0xd70 [i915]
      intel_setup_outputs+0x79d/0xbc0 [i915]
      intel_modeset_init_nogem+0x1a1/0x300 [i915]
      i915_driver_probe+0x2cd/0x580 [i915]
      i915_pci_probe+0xcd/0x150 [i915]
      local_pci_probe+0x44/0xa0
      pci_call_probe+0x54/0x160
      pci_device_probe+0x7e/0x100
      really_probe+0x197/0x3c0

Signed-off-by: Yongxin Liu <yongxin.liu@...driver.com>
---
 drivers/gpu/drm/i915/display/intel_dp.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c
index f4192fda1a76..9ae003b41b4a 100644
--- a/drivers/gpu/drm/i915/display/intel_dp.c
+++ b/drivers/gpu/drm/i915/display/intel_dp.c
@@ -5575,6 +5575,7 @@ static bool intel_edp_init_connector(struct intel_dp *intel_dp,
 
 out_vdd_off:
 	intel_pps_vdd_off_sync(intel_dp);
+	intel_bios_fini_panel(&intel_connector->panel);
 
 	return false;
 }
-- 
2.39.2