linux-kernel - Re: [PATCH 1/3] drm/connector: hdmi: Fix memory leak in drm_display_mode_from_cea

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <dbe9c1c8-6c5c-f2da-545d-73e6fa535d8a@huawei.com>
Date: Mon, 14 Oct 2024 17:15:31 +0800
From: Jinjie Ruan <ruanjinjie@...wei.com>
To: Maxime Ripard <mripard@...nel.org>
CC: <maarten.lankhorst@...ux.intel.com>, <tzimmermann@...e.de>,
	<airlied@...il.com>, <simona@...ll.ch>, <christian.koenig@....com>,
	<ray.huang@....com>, <dmitry.baryshkov@...aro.org>,
	<dave.stevenson@...pberrypi.com>, <mcanal@...lia.com>,
	<quic_jjohnson@...cinc.com>, <karolina.stolarek@...el.com>,
	<Arunpravin.PaneerSelvam@....com>, <thomas.hellstrom@...ux.intel.com>,
	<asomalap@....com>, <dri-devel@...ts.freedesktop.org>,
	<linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 1/3] drm/connector: hdmi: Fix memory leak in
 drm_display_mode_from_cea_vic()



On 2024/10/14 17:11, Maxime Ripard wrote:
> On Mon, Oct 14, 2024 at 03:16:30PM GMT, Jinjie Ruan wrote:
>> modprobe drm_connector_test and then rmmod drm_connector_test,
>> the following memory leak occurs.
>>
>> The `mode` allocated in drm_mode_duplicate() called by
>> drm_display_mode_from_cea_vic() is not freed, which cause the memory leak:
>>
>> 	unreferenced object 0xffffff80cb0ee400 (size 128):
>> 	  comm "kunit_try_catch", pid 1948, jiffies 4294950339
>> 	  hex dump (first 32 bytes):
>> 	    14 44 02 00 80 07 d8 07 04 08 98 08 00 00 38 04  .D............8.
>> 	    3c 04 41 04 65 04 00 00 05 00 00 00 00 00 00 00  <.A.e...........
>> 	  backtrace (crc 90e9585c):
>> 	    [<00000000ec42e3d7>] kmemleak_alloc+0x34/0x40
>> 	    [<00000000d0ef055a>] __kmalloc_cache_noprof+0x26c/0x2f4
>> 	    [<00000000c2062161>] drm_mode_duplicate+0x44/0x19c
>> 	    [<00000000f96c74aa>] drm_display_mode_from_cea_vic+0x88/0x98
>> 	    [<00000000d8f2c8b4>] 0xffffffdc982a4868
>> 	    [<000000005d164dbc>] kunit_try_run_case+0x13c/0x3ac
>> 	    [<000000006fb23398>] kunit_generic_run_threadfn_adapter+0x80/0xec
>> 	    [<000000006ea56ca0>] kthread+0x2e8/0x374
>> 	    [<000000000676063f>] ret_from_fork+0x10/0x20
>> 	......
>>
>> Free `mode` by calling drm_mode_destroy() to fix it.
>>
>> Cc: stable@...r.kernel.org
>> Fixes: abb6f74973e2 ("drm/tests: Add HDMI TDMS character rate tests")
>> Signed-off-by: Jinjie Ruan <ruanjinjie@...wei.com>
>> ---
>>  drivers/gpu/drm/tests/drm_connector_test.c | 24 ++++++++++++++++++++++
>>  1 file changed, 24 insertions(+)
>>
>> diff --git a/drivers/gpu/drm/tests/drm_connector_test.c b/drivers/gpu/drm/tests/drm_connector_test.c
>> index 15e36a8db685..9c94d26b3486 100644
>> --- a/drivers/gpu/drm/tests/drm_connector_test.c
>> +++ b/drivers/gpu/drm/tests/drm_connector_test.c
>> @@ -1004,6 +1004,8 @@ static void drm_test_drm_hdmi_compute_mode_clock_rgb(struct kunit *test)
>>  	rate = drm_hdmi_compute_mode_clock(mode, 8, HDMI_COLORSPACE_RGB);
>>  	KUNIT_ASSERT_GT(test, rate, 0);
>>  	KUNIT_EXPECT_EQ(test, mode->clock * 1000ULL, rate);
>> +
>> +	drm_mode_destroy(drm, mode);
>>  }
> 
> If KUNIT_ASSERT_GT triggers, then we would end up leaking the mode as well.
> 
> I think we should create a kunit_drm_display_mode_from_cea_vic()
> function that registers a kunit action to free the mode when the test is
> done.

You are right! That will be nice and could be used by the new KUNIT test
modules.

> 
> Maxime