TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

drm/syncobj: Fix syncobj leak in drm_syncobj_eventfd_ioctl

Browse Source 
commit 8c7c44be57 upstream.

A syncobj reference is taken in drm_syncobj_find, but not released if
eventfd_ctx_fdget or kzalloc fails. Put the reference in these error
paths.

Reported-by: Xingyu Jin <xingyuj@google.com>
Fixes: c7a4722971 ("drm/syncobj: add IOCTL to register an eventfd")
Signed-off-by: T.J. Mercier <tjmercier@google.com>
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Reviewed-by. Christian König <christian.koenig@amd.com>
CC: stable@vger.kernel.org # 6.6+
Link: https://patchwork.freedesktop.org/patch/msgid/20240909205400.3498337-1-tjmercier@google.com
Signed-off-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
T.J. Mercier
2024-09-09 20:53:59 +00:00
committed by Greg Kroah-Hartman
parent 28425a10a4
commit 8e1ffb2579
1 changed files with 13 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/gpu/drm/drm_syncobj.c
+13 -4
View File
@@ -1421,6 +1421,7 @@ drm_syncobj_eventfd_ioctl(struct drm_device *dev, void *data,
struct drm_syncobj *syncobj;
struct eventfd_ctx *ev_fd_ctx;
struct syncobj_eventfd_entry *entry;
int ret;
if (!drm_core_check_feature(dev, DRIVER_SYNCOBJ_TIMELINE))
return -EOPNOTSUPP;
@@ -1436,13 +1437,15 @@ drm_syncobj_eventfd_ioctl(struct drm_device *dev, void *data,
return -ENOENT;
ev_fd_ctx = eventfd_ctx_fdget(args->fd);
if (IS_ERR(ev_fd_ctx))
return PTR_ERR(ev_fd_ctx);
if (IS_ERR(ev_fd_ctx)) {
ret = PTR_ERR(ev_fd_ctx);
goto err_fdget;
}
entry = kzalloc(sizeof(*entry), GFP_KERNEL);
if (!entry) {
eventfd_ctx_put(ev_fd_ctx);
return -ENOMEM;
ret = -ENOMEM;
goto err_kzalloc;
}
entry->syncobj = syncobj;
entry->ev_fd_ctx = ev_fd_ctx;
@@ -1453,6 +1456,12 @@ drm_syncobj_eventfd_ioctl(struct drm_device *dev, void *data,
drm_syncobj_put(syncobj);
return 0;
err_kzalloc:
eventfd_ctx_put(ev_fd_ctx);
err_fdget:
drm_syncobj_put(syncobj);
return ret;
}
int