Commit 1175c643 authored by Hangyu Hua's avatar Hangyu Hua Committed by Zicheng Qu
Browse files

drm: msm: fix possible memory leak in mdp5_crtc_cursor_set() 

stable inclusion
from stable-v4.19.247
commit f8cd192752a1f613b14eee77783c6f0aebb49691
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1JW
CVE: CVE-2022-49467

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f8cd192752a1f613b14eee77783c6f0aebb49691



--------------------------------

[ Upstream commit 947a844b ]

drm_gem_object_lookup will call drm_gem_object_get inside. So cursor_bo
needs to be put when msm_gem_get_and_pin_iova fails.

Fixes: e172d10a ("drm/msm/mdp5: Add hardware cursor support")
Signed-off-by: default avatarHangyu Hua <hbh25y@gmail.com>
Link: https://lore.kernel.org/r/20220509061125.18585-1-hbh25y@gmail.com


Signed-off-by: default avatarRob Clark <robdclark@chromium.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarZicheng Qu <quzicheng@huawei.com>
parent 4d1e2474

drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c

+3 −1
Original line number Diff line number Diff line
@@ -911,8 +911,10 @@ static int mdp5_crtc_cursor_set(struct drm_crtc *crtc, 


	ret = msm_gem_get_iova(cursor_bo, kms->aspace,

			&mdp5_crtc->cursor.iova);

	if (ret)

	if (ret) {

		drm_gem_object_put(cursor_bo);

		return -EINVAL;

	}



	pm_runtime_get_sync(&pdev->dev);