Commit 2edbcaaf authored Oct 17, 2024 by Zhipeng Lu Committed by Guo Mengqi Oct 17, 2024

drm/lima: fix a memleak in lima_heap_alloc

stable inclusion
from stable-v5.10.214
commit f2e80ac9344aebbff576453d5c0290b332e187ed
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q978
CVE: CVE-2024-35829

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f2e80ac9344aebbff576453d5c0290b332e187ed



--------------------------------

[ Upstream commit 04ae3eb470e52a3c41babe85ff8cee195e4dcbea ]

When lima_vm_map_bo fails, the resources need to be deallocated, or
there will be memleaks.

Fixes: 6aebc51d ("drm/lima: support heap buffer creation")
Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
Signed-off-by: Qiang Yu <yuq825@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240117071328.3811480-1-alexious@zju.edu.cn


Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Signed-off-by: Guo Mengqi <guomengqi3@huawei.com>

parent 5d655da7

drivers/gpu/drm/lima/lima_gem.c

+14 −9

Original line number	Diff line number	Diff line
		@@ -74,29 +74,34 @@ int lima_heap_alloc(struct lima_bo bo, struct lima_vm vm)
		} else {
		bo->base.sgt = kmalloc(sizeof(*bo->base.sgt), GFP_KERNEL);
		if (!bo->base.sgt) {
		sg_free_table(&sgt);
		return -ENOMEM;
		ret = -ENOMEM;
		goto err_out0;
		}
		}

		ret = dma_map_sgtable(dev, &sgt, DMA_BIDIRECTIONAL, 0);
		if (ret) {
		sg_free_table(&sgt);
		kfree(bo->base.sgt);
		bo->base.sgt = NULL;
		return ret;
		}
		if (ret)
		goto err_out1;

		*bo->base.sgt = sgt;

		if (vm) {
		ret = lima_vm_map_bo(vm, bo, old_size >> PAGE_SHIFT);
		if (ret)
		return ret;
		goto err_out2;
		}

		bo->heap_size = new_size;
		return 0;

		err_out2:
		dma_unmap_sgtable(dev, &sgt, DMA_BIDIRECTIONAL, 0);
		err_out1:
		kfree(bo->base.sgt);
		bo->base.sgt = NULL;
		err_out0:
		sg_free_table(&sgt);
		return ret;
		}

		int lima_gem_create_handle(struct drm_device dev, struct drm_file file,