Commit fcb4f919 authored by LongJun Tang's avatar LongJun Tang Committed by Alex Deucher
Browse files

drm/amd/display: Have risk for memory exhaustion 



In dcn*_clock_source_create when dcn*_clk_src_construct fails allocated
clk_src needs release. A local attack could use this to cause memory
exhaustion.

Signed-off-by: default avatarLongJun Tang <tanglongjun@kylinos.cn>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
parent e50db383

drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c

+1 −0
Original line number Diff line number Diff line
@@ -1328,6 +1328,7 @@ static struct clock_source *dcn30_clock_source_create( 
		return &clk_src->base;

	}



	kfree(clk_src);

	BREAK_TO_DEBUGGER();

	return NULL;

}

drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c

+1 −0
Original line number Diff line number Diff line
@@ -1288,6 +1288,7 @@ static struct clock_source *dcn301_clock_source_create( 
		return &clk_src->base;

	}



	kfree(clk_src);

	BREAK_TO_DEBUGGER();

	return NULL;

}

drivers/gpu/drm/amd/display/dc/dcn302/dcn302_resource.c

+1 −0
Original line number Diff line number Diff line
@@ -464,6 +464,7 @@ static struct clock_source *dcn302_clock_source_create(struct dc_context *ctx, s 
		return &clk_src->base;

	}



	kfree(clk_src);

	BREAK_TO_DEBUGGER();

	return NULL;

}

drivers/gpu/drm/amd/display/dc/dcn303/dcn303_resource.c

+1 −0
Original line number Diff line number Diff line
@@ -431,6 +431,7 @@ static struct clock_source *dcn303_clock_source_create(struct dc_context *ctx, s 
		return &clk_src->base;

	}



	kfree(clk_src);

	BREAK_TO_DEBUGGER();

	return NULL;

}

drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c

+1 −0
Original line number Diff line number Diff line
@@ -1629,6 +1629,7 @@ static struct clock_source *dcn31_clock_source_create( 
		return &clk_src->base;

	}



	kfree(clk_src);

	BREAK_TO_DEBUGGER();

	return NULL;

}