From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CF3524431 for ; Wed, 15 Mar 2023 12:39:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 59477C433A7; Wed, 15 Mar 2023 12:39:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1678883941; bh=VwdZI8/Vy7+BoFJ7kt/D42QSaD+nspysXt+cM/Cuu9s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=t/icestHD/Y1hf8qbjsugWK9VQebXOvGjt9aV2xtXynu9Zu5wmirOTKnPLYyXXVqi 2SssJT519IMwdPR0BXIQSDm+m+kjmzmBhPVYhphG+MLHQJ3iQPXOh/7vk7Ztytvef9 Bu++0GQcvUNoCOkuwPGG8okO13/RM0Lk+TKjw6rg= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Rob Clark , Dmitry Baryshkov , Dmitry Osipenko , Sasha Levin Subject: [PATCH 6.2 047/141] drm/msm: Fix potential invalid ptr free Date: Wed, 15 Mar 2023 13:12:30 +0100 Message-Id: <20230315115741.401173773@linuxfoundation.org> X-Mailer: git-send-email 2.40.0 In-Reply-To: <20230315115739.932786806@linuxfoundation.org> References: <20230315115739.932786806@linuxfoundation.org> User-Agent: quilt/0.67 Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Rob Clark [ Upstream commit 8a86f213f4426f19511a16d886871805b35c3acf ] The error path cleanup expects that chain and syncobj are either NULL or valid pointers. But post_deps was not allocated with __GFP_ZERO. Fixes: ab723b7a992a ("drm/msm: Add syncobj support.") Signed-off-by: Rob Clark Reviewed-by: Dmitry Baryshkov Reviewed-by: Dmitry Osipenko Patchwork: https://patchwork.freedesktop.org/patch/523051/ Link: https://lore.kernel.org/r/20230215235048.1166484-1-robdclark@gmail.com Signed-off-by: Sasha Levin --- drivers/gpu/drm/msm/msm_gem_submit.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c index 1c4be193fd23f..8ac1cd27746a0 100644 --- a/drivers/gpu/drm/msm/msm_gem_submit.c +++ b/drivers/gpu/drm/msm/msm_gem_submit.c @@ -626,8 +626,8 @@ static struct msm_submit_post_dep *msm_parse_post_deps(struct drm_device *dev, int ret = 0; uint32_t i, j; - post_deps = kmalloc_array(nr_syncobjs, sizeof(*post_deps), - GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY); + post_deps = kcalloc(nr_syncobjs, sizeof(*post_deps), + GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY); if (!post_deps) return ERR_PTR(-ENOMEM); @@ -642,7 +642,6 @@ static struct msm_submit_post_dep *msm_parse_post_deps(struct drm_device *dev, } post_deps[i].point = syncobj_desc.point; - post_deps[i].chain = NULL; if (syncobj_desc.flags) { ret = -EINVAL; -- 2.39.2