From patchwork Mon Dec 2 04:51:31 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Po-Hsu Lin X-Patchwork-Id: 1202924 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=canonical.com Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 47RCPx207Bz9sPV; Mon, 2 Dec 2019 15:51:49 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1ibdgW-0003dr-RZ; Mon, 02 Dec 2019 04:51:44 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1ibdgV-0003dY-Ik for kernel-team@lists.ubuntu.com; Mon, 02 Dec 2019 04:51:43 +0000 Received: from mail-pg1-f197.google.com ([209.85.215.197]) by youngberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1ibdgV-00053i-99 for kernel-team@lists.ubuntu.com; Mon, 02 Dec 2019 04:51:43 +0000 Received: by mail-pg1-f197.google.com with SMTP id f18so20920415pgh.18 for ; Sun, 01 Dec 2019 20:51:43 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references; bh=fWnIMJJCZmqA/x2MvcnKMdei+tDzYRO5iU+AYd/lTR8=; b=BiKm1s7AFMk/S2GBWugKuE2aGkTk9jL7FU/K5/xVwe6qWwDqxYDvRAkxdTguLqRzWf 5IDSNaBbwlANw9bZDTwl8QtHFq+HdaAl5Rva1XHGHhQn6l2vhM9oflKJca75gBU+kSYy iOujy9IyREpQYiPjL3sG6hgEAK3zQiEjHo4pAaWDfZkI4zd61MO9aPuShuh3eHv7T0D4 KZLw43MJX2jZEuImzdAaI56OG1ZLkkoKxMTJBA0j+Q8SB9RQp+t931Kfndkf+LuudZ7e 7zjTgFSyakc24wEJ3Za+D/sWvEFwTAQUnxsYQZB6Mb2w/2mqoQmMBPSSx33pOuKnT+nF Xh3Q== X-Gm-Message-State: APjAAAUK2Nh/5b/7oW0Z3pM3fbqsbHSqxt7sO52sOnwahpKCsmu3FQq2 m77rwGlwBNFkRmbBgeVzSgsPqCY/D8kH0+l/pfZFG1v02Mm95qX3VImkMevJO5nt1eCKSJv5Lw3 EvRqF17+kLv7yBcJdc4BDn21kJsOFZJ+i/fVU3ptQ X-Received: by 2002:a17:902:5999:: with SMTP id p25mr3678834pli.261.1575262301660; Sun, 01 Dec 2019 20:51:41 -0800 (PST) X-Google-Smtp-Source: APXvYqz15Z7jd+0LCGrrJ8Qs0pPzfj+GT7WfrCOSJo6GX1KByJtcbGHx235k3I37BvX4tmL0Slq0Dw== X-Received: by 2002:a17:902:5999:: with SMTP id p25mr3678822pli.261.1575262301298; Sun, 01 Dec 2019 20:51:41 -0800 (PST) Received: from Leggiero.taipei.internal (61-220-137-37.HINET-IP.hinet.net. [61.220.137.37]) by smtp.gmail.com with ESMTPSA id c18sm7700254pgj.24.2019.12.01.20.51.40 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Dec 2019 20:51:40 -0800 (PST) From: Po-Hsu Lin To: kernel-team@lists.ubuntu.com Subject: [B][D][SRU][CVE-2019-19082][PATCH 1/1] drm/amd/display: prevent memory leak Date: Mon, 2 Dec 2019 12:51:31 +0800 Message-Id: <20191202045132.21881-2-po-hsu.lin@canonical.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20191202045132.21881-1-po-hsu.lin@canonical.com> References: <20191202045132.21881-1-po-hsu.lin@canonical.com> X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Navid Emamdoost CVE-2019-19082 In dcn*_create_resource_pool the allocated memory should be released if construct pool fails. Reviewed-by: Harry Wentland Signed-off-by: Navid Emamdoost Signed-off-by: Alex Deucher (cherry picked from commit 104c307147ad379617472dd91a5bcb368d72bd6d) Signed-off-by: Po-Hsu Lin --- drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c | 1 + drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c | 1 + drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c | 1 + drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c | 1 + drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c | 1 + 5 files changed, 5 insertions(+) diff --git a/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c b/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c index 515e76c..8839e84 100644 --- a/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c @@ -940,6 +940,7 @@ struct resource_pool *dce100_create_resource_pool( if (construct(num_virtual_links, dc, pool)) return &pool->base; + kfree(pool); BREAK_TO_DEBUGGER(); return NULL; } diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c index 42df17f..3cf5871 100644 --- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c @@ -1324,6 +1324,7 @@ struct resource_pool *dce110_create_resource_pool( if (construct(num_virtual_links, dc, pool, asic_id)) return &pool->base; + kfree(pool); BREAK_TO_DEBUGGER(); return NULL; } diff --git a/drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c b/drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c index 663e0a0..65c3fe3 100644 --- a/drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c @@ -1278,6 +1278,7 @@ struct resource_pool *dce112_create_resource_pool( if (construct(num_virtual_links, dc, pool)) return &pool->base; + kfree(pool); BREAK_TO_DEBUGGER(); return NULL; } diff --git a/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c b/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c index 5c48c22..184ebed 100644 --- a/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c @@ -999,6 +999,7 @@ struct resource_pool *dce120_create_resource_pool( if (construct(num_virtual_links, dc, pool)) return &pool->base; + kfree(pool); BREAK_TO_DEBUGGER(); return NULL; } diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c index 9fc8f82..f3edc41 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c @@ -1463,6 +1463,7 @@ struct resource_pool *dcn10_create_resource_pool( if (construct(num_virtual_links, dc, pool)) return &pool->base; + kfree(pool); BREAK_TO_DEBUGGER(); return NULL; }