Commit 50783b0b authored by Jingwen Chen's avatar Jingwen Chen Committed by Liu Mingrui
Browse files

drm/amd/amdgpu: fix refcount leak 

stable inclusion
from stable-v4.19.193
commit 599e5d61ace952b0bb9bd942b198bbd0cfded1d7
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BGUR
CVE: CVE-2021-47144

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=599e5d61ace952b0bb9bd942b198bbd0cfded1d7



--------------------------------

[ Upstream commit fa7e6abc ]

[Why]
the gem object rfb->base.obj[0] is get according to num_planes
in amdgpufb_create, but is not put according to num_planes

[How]
put rfb->base.obj[0] in amdgpu_fbdev_destroy according to num_planes

Signed-off-by: default avatarJingwen Chen <Jingwen.Chen2@amd.com>
Acked-by: default avatarChristian König <christian.koenig@amd.com>
Reviewed-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarLiu Mingrui <liumingrui@huawei.com>
parent 1ed85cbd

drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c

+3 −0
Original line number Diff line number Diff line
@@ -297,10 +297,13 @@ static int amdgpufb_create(struct drm_fb_helper *helper, 
static int amdgpu_fbdev_destroy(struct drm_device *dev, struct amdgpu_fbdev *rfbdev)

{

	struct amdgpu_framebuffer *rfb = &rfbdev->rfb;

	int i;



	drm_fb_helper_unregister_fbi(&rfbdev->helper);



	if (rfb->base.obj[0]) {

		for (i = 0; i < rfb->base.format->num_planes; i++)

			drm_gem_object_put(rfb->base.obj[0]);

		amdgpufb_destroy_pinned_object(rfb->base.obj[0]);

		rfb->base.obj[0] = NULL;

		drm_framebuffer_unregister_private(&rfb->base);