Potential Memory Leak Bugs in drivers/gpu/drm/virtio/virtgpu_vq.c (Linux 5.6).

[Dongyang Zhan <zdyzztq@gmail.com>]

Hi,
My name is Dongyang Zhan, I am a security researcher.
Currently, I found two possible memory bugs in
drivers/gpu/drm/virtio/virtgpu_vq.c (Linux 5.6).
I hope you can help me to confirm them. Thank you.

The first one is resp_buf will not be release in
virtio_gpu_cmd_get_display_info() with the condition
(resp_size <= MAX_INLINE_RESP_SIZE) in virtio_gpu_alloc_cmd_resp().

int virtio_gpu_cmd_get_display_info(struct virtio_gpu_device *vgdev)
{
struct virtio_gpu_ctrl_hdr *cmd_p;
struct virtio_gpu_vbuffer *vbuf;
void *resp_buf;
...
resp_buf = kzalloc(sizeof(struct virtio_gpu_resp_display_info), GFP_KERNEL);
if (!resp_buf)
     return -ENOMEM;
cmd_p =virtio_gpu_alloc_cmd_resp(vgdev,&virtio_gpu_cmd_get_display_info_cb,
&vbuf,
sizeof(*cmd_p), sizeof(struct virtio_gpu_resp_display_info),resp_buf); //
memset(cmd_p, 0, sizeof(*cmd_p));
...
return 0;
}

virtio_gpu_get_vbuf(struct virtio_gpu_device *vgdev,
   int size, int resp_size, void *resp_buf,
   virtio_gpu_resp_cb resp_cb)
{
struct virtio_gpu_vbuffer *vbuf;

vbuf = kmem_cache_zalloc(vgdev->vbufs, GFP_KERNEL);
if (!vbuf)
return ERR_PTR(-ENOMEM);

BUG_ON(size > MAX_INLINE_CMD_SIZE);
vbuf->buf = (void *)vbuf + sizeof(*vbuf);
vbuf->size = size;

vbuf->resp_cb = resp_cb;
vbuf->resp_size = resp_size;
if (resp_size <= MAX_INLINE_RESP_SIZE)
vbuf->resp_buf = (void *)vbuf->buf + size; // resp_buf will never be released.
else
vbuf->resp_buf = resp_buf;
BUG_ON(!vbuf->resp_buf);
return vbuf;
}

The second one is in virtio_gpu_cmd_get_edids(), which is similar with
the last one. resp_buf will not be released.
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel