linux-kernel - Re: [PATCH] drm: Use kvmemdup/kvfree for EDID data

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2040b1e245eb0166079ff985c52775e9ade9eab5@intel.com>
Date: Mon, 08 Sep 2025 16:54:35 +0300
From: Jani Nikula <jani.nikula@...ux.intel.com>
To: Zilin Guan <zilin@....edu.cn>, maarten.lankhorst@...ux.intel.com
Cc: mripard@...nel.org, tzimmermann@...e.de, airlied@...il.com,
 simona@...ll.ch, dri-devel@...ts.freedesktop.org,
 linux-kernel@...r.kernel.org, jianhao.xu@....edu.cn, Zilin Guan
 <zilin@....edu.cn>
Subject: Re: [PATCH] drm: Use kvmemdup/kvfree for EDID data

On Fri, 05 Sep 2025, Zilin Guan <zilin@....edu.cn> wrote:
> The drm_edid_alloc() function uses kmemdup() to copy raw EDID data,
> which can be loaded from firmware. A problem exists because the firmware
> subsystem uses vfree() to release its data buffer. This implies the
> buffer may be allocated with vmalloc() and can thus be larger than
> kmalloc() typically supports. Since kmemdup() uses kmalloc() internally,
> attempting to duplicate a large, vmalloc'd EDID buffer can lead to an
> allocation failure.

Real world EDIDs are usually under 1 kB and if the user provides a much
bigger EDID via the firmware loader it's okay to fail at the allocation
time.

BR,
Jani.

>
> To fix this mismatch and robustly handle EDID data of any size, this
> patch replaces kmemdup() with kvmemdup(). The kvmemdup() function is
> designed for this scenario, as it can safely handle a vmalloc'd source
> and choose an appropriate allocator for the destination. The corresponding
> free calls are therefore updated to kvfree().
>
> Signed-off-by: Zilin Guan <zilin@....edu.cn>
> ---
>  drivers/gpu/drm/drm_edid.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
> index e2e85345aa9a..97142bfc45ad 100644
> --- a/drivers/gpu/drm/drm_edid.c
> +++ b/drivers/gpu/drm/drm_edid.c
> @@ -2530,13 +2530,13 @@ const struct drm_edid *drm_edid_alloc(const void *edid, size_t size)
>  	if (!edid || !size || size < EDID_LENGTH)
>  		return NULL;
>  
> -	edid = kmemdup(edid, size, GFP_KERNEL);
> +	edid = kvmemdup(edid, size, GFP_KERNEL);
>  	if (!edid)
>  		return NULL;
>  
>  	drm_edid = _drm_edid_alloc(edid, size);
>  	if (!drm_edid)
> -		kfree(edid);
> +		kvfree(edid);
>  
>  	return drm_edid;
>  }
> @@ -2568,7 +2568,7 @@ void drm_edid_free(const struct drm_edid *drm_edid)
>  	if (!drm_edid)
>  		return;
>  
> -	kfree(drm_edid->edid);
> +	kvfree(drm_edid->edid);
>  	kfree(drm_edid);
>  }
>  EXPORT_SYMBOL(drm_edid_free);

-- 
Jani Nikula, Intel