Commit 3762ed65 authored by Jani Nikula's avatar Jani Nikula Committed by liwei
Browse files

drm/exynos/vidi: fix memory leak in .get_modes() 

mainline inclusion
from mainline-v6.10-rc4
commit 38e3825631b1f314b21e3ade00b5a4d737eb054e
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACV3A
CVE: CVE-2024-40932

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=38e3825631b1f314b21e3ade00b5a4d737eb054e



----------------------------------

The duplicated EDID is never freed. Fix it.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarJani Nikula <jani.nikula@intel.com>
Signed-off-by: default avatarInki Dae <inki.dae@samsung.com>
Signed-off-by: default avatarliwei <liwei728@huawei.com>
parent a96cb8eb

drivers/gpu/drm/exynos/exynos_drm_vidi.c

+6 −1
Original line number Diff line number Diff line
@@ -302,6 +302,7 @@ static int vidi_get_modes(struct drm_connector *connector) 
	struct vidi_context *ctx = ctx_from_connector(connector);

	struct edid *edid;

	int edid_len;

	int count;



	/*

	 * the edid data comes from user side and it would be set
@@ -321,7 +322,11 @@ static int vidi_get_modes(struct drm_connector *connector) 


	drm_connector_update_edid_property(connector, edid);



	return drm_add_edid_modes(connector, edid);

	count = drm_add_edid_modes(connector, edid);



	kfree(edid);



	return count;

}



static const struct drm_connector_helper_funcs vidi_connector_helper_funcs = {